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Representative Gary Connor 
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RE: Audit of Medicaid and the Children's Insurance Program for Fiscal Year 2006 

Dear Chair Brannigan, Chair Perry, and all Honorable members of the Committee: 

I am pleased to present you this report on our audit of Medicaid and the State Children's 
Insurance Program (SCHIP) for state fiscal year 2006. The Maine Department of Audit 
examined 26 major federal programs in total as part of our Single Audit of fiscal year 2006. Our 
audit covered programs that represent 89% of the $2.8 Billion in federal assistance that Maine 
received during that fiscal year. The Medicaid Program accounts for an enormous share of that 
federal assistance: Medicaid spending, both State and federal dollars, was over $2 Billion in 
2006. In presenting you with the highlights of our audit, and in consideration of the special 
emphasis that you are placing on Medicaid, I chose to focus on these two important programs 
alone. 

However, they are just two of the fifteen programs receiving federal assistance that are 
administered by the Maine Department of Health and Human Services. This report aims to help 
you understand the depth and breadth of our audit of Medicaid and SCHIP, as well as the skill 
and abilities of our auditors. I have asked the Medicaid audit team for 2006 to accompany me, 
and we will try to answer any questions that you may have following the presentation. Please 
remember that we would be happy to return to report on the other programs that we audited that 
are under your jurisdiction. In addition, we are available to research questions specific to your 
interests to the fullest extent possible. 



Sincerely, 




State Auditor, JD, CIA 
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Executive 
Summary 

2006 Medicaid 
and SCHIP 
Audits 

Medicaid - 

$2 Billion program 

64% federal funds 

SCHIP - 

$33 Million program 
76% federal funds 



Planning - 
Risk Assessment 
Audit efficiency 



We met with many 
program managers 

We went to regional 
offices 



We audited Medicaid and the Children's Insurance Program 
as part of the State Single Audit for fiscal year 2006. Our 
audit serves to verify that funds appropriated by the 
Legislature are accurately accounted for, expended for the 
programs and purposes intended, and have effective controls 
in place to ensure compliance with laws and regulations, 
both state and federal. In addition, it satisfies federal audit 
requirements associated with the State's expenditure of 
federal grant awards. 

Medicaid is a $2 billion program, funded 64% by federal 
funds. Medicaid is the largest program administered by the 
State. 

SCHIP is a $33 million program, funded 76% with federal 
financial participation 



We assessed the risk associated with the Medicaid program 
as high due to its size, its complexity and the number of 
internal control and compliance issues identified in prior 
audits. Because Medicaid and SCHIP are administered by 
many of the same people, share information technology 
systems, are both health insurance programs and because 
clients may be eligible for one or the other, we achieved 
audit efficiency by assigning the audits of both programs to 
the same team of five very experienced auditors. 



Our work required us to meet with staff and test systems 
throughout the Department of Health and Human Services. 
We met with accounting and program managers in Financial 
Management Services, the Director of Internal Audit, the 
Office of MaineCare Services, the DHHS Division of Audit, 
the Program Integrity Unit, the Division of Purchased 
Services, the Office of Integrated Access and Support, the 
Fraud Investigation and Recovery Unit (FIRU), the Rate 
Setting Unit and Licensing & Regulatory Enforcement. We 
spoke with the Office of Fiscal and Program Review. Our 
examination took us to regional offices in Augusta, Bangor, 
Portland and Lewiston to examine client case files and to 
review business operations. 
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We traced 
electronic payments 

We saw private 
contractors and 
providers 



We tested 
electronic 

information systems 



MECMS 

MMDSS 

EIS 

ACES 

WELFRE 

MACWIS 



We tested claims 
data 



We consulted 
legal counsel 



We traced payments to electronic data submitted by 
Medicaid providers. We went on-site at Goold Health Care 
to examine the prescription drug payment processes and 
interfaces with eligibility and payment systems. We 
contacted pharmacies throughout the state to confirm that 
they had supporting documentation that drugs paid for had 
been prescribed by a physician and were dispensed and 
billed appropriately. We also obtained detailed records from 
MR Waiver providers to confirm services provided. 



We accessed multiple DHHS information systems including 
MECMS, MMDSS, EIS, ACES, WELFRE, and MACWIS. 
We tested the system to system integrity of client eligibility 
data. We include flow charts on eligibility data systems and 
payment data flows. 



We worked with Department of Administrative and 
Financial Services employees in the Office of Information 
Technology to address system interface issues, the 
sufficiency of documentation and understanding of processes 
and controls. We worked with the Health and Human 
Services Service Center and the Office of the State 
Controller on many accounting and financial reporting 
issues. We confirmed with Maine Revenue Services (MRS) 
the process and proceeds resulting from the Service Provider 
Tax and also the transition of eligibility determination for 
Maine Rx and Drugs for the Elderly from MRS to OIAS. 



We tested claims data and client count information provided 
to the Deloitte actuaries. We found errors in the data 
provided, and our work was used to ensure a more accurate 
actuarial valuation of the Medicaid liability for Incurred but 
Not Reported Claims. We also met with Deloitte accountants 
and consultants on Interim Payments and estimates of the 
associated bad debt. We worked with other DHHS 
consultants and contractors, including CNSI and XWave to 
validate reported amounts and processes. 



We consulted with the Office of the Attorney General, 
Medicaid Fraud Division, and FIRU legal counsel. We met 
as well as with the Assistant Attorney General for General 
Government and DHHS legal counsel for Medicaid. 
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We confirmed data 



Conclusions 



MECMS not 
functional 

HCBS waiver rates 

insufficiently 

documented 

SCHIP eligibility 
error rate concern 



Potential Cost 
savings: 
Medicare Part B 
Cost of Care 
deductible 
Pharmacy payment 



HCBS waiver 
improper billing 



We contacted and confirmed or obtained information and/or 
data from the Department of Corrections, the USM Muskie 
Center, the Regional Administrator for Social Security 
Administration, the Centers for Medicare and Medicaid 
Services, and the regional Inspector General for Health and 
Human Services. 



We found many of the areas that we tested to be accurately 
reported, to have sufficient internal controls and to be in 
compliance. Those areas are not identified in this report 
other than as noted in the preceding procedures section. 



We identified material noncompliance for each program that 
caused us to issue a qualified opinion for each. The 
Medicaid program does not have a fully functional claims 
management system; also, we could not obtain 
documentation to support payment rates established for the 
Home and Community Based Services Medicaid Waiver. 
The State Children's Insurance Program had significant 
eligibility error rates, which resulted in a qualified opinion. 



We found areas that could result in potential cost savings. As 
we have discussed these with the Department, they may have 
already initiated action to realize savings. For example, 
Medicare Part B coverage was paid for individuals not 
eligible to be paid for by Medicaid. The Cost of Care 
deductible was not subtracted from payments to nursing 
home providers, thereby increasing the cost to the State. The 
State's payments to pharmacies did not ensure that payment 
did not exceed the usual and customary charges. 



Our testing of payments to Waiver providers found that one 
provider billed early for services provided and one over 
billed - MECMS edit and limit checks did not prevent 
either. 
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We recommend: 

SURS and FIRU 
support 



Improve electronic 
eligibility systems 



Specifics are in 
each finding 
summary 



We noted that the Program Integrity Unit has been 
understaffed and that little to no Medicaid recipient fraud 
testing is being done. 



A major area of concern is inadequate controls over 
Medicaid/SCHIP eligibility. We found that systems 
interfaces cause ACES to have different eligibility 
determinations than result in MECMS eligibility 
determination tables. Clients may be paid from the wrong 
program. System reports do not agree. We found that all 
required income eligibility verification cross-matches were 
not being done and that one such data exchange repeatedly 
reopened cases closed by caseworkers. 



We have included summary information of the results of our 
testing. The summaries indicate the amounts questioned due 
to noncompliance and the areas in which we found 
noncompliance. The detail of each audit finding is included. 
We have also included a flowchart of information systems 
that we prepared to assist in planning our audit. OIT has 
since prepared a more detailed overview of IT systems. 
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2006 Summary of Medicaid and SCHIP Audit Findings 



No. 


Federal Program 


Description 


Activities Allowed 


Allowable Costs 


Cash Management 


Davis-Bacon Act 


Eligibility 


Matching, Level of Effort, Earmarking 


Period of Availability 


Procurement and Suspension and Debarment 


Program Income 


Reporting 


Subrecipient Monitoring 


Special Tests 


Known 

Questioned 

Costs 


Likely 

Questioned 

Costs 


1 


Children' s Insurance - 
SCHIP 


Estimated expenditures reported 






























2 


Medicaid Cluster 


Over billing of Waiver costs 


✓ 
























$130,912 


undeterminable 


3 


Medicaid Cluster 


Insufficient claims payment controls 


























$12,173 


undeterminable 


4 


Medicaid Cluster 


Financial Accountability-Payment 
rates 


✓ 
























undeterminable 


undeterminable 


5 


Medicaid Cluster 


Unallowable targeted case 
management charges to Medicaid 


























$27,870 


$10,600,000 


6 


Medicaid Cluster 


Medicare Part B eligibility 


✓ 
























$112 


$1,186,020 


7 


Medicaid Cluster 


Unallowable Waiver transportation 
costs 
























•/ 


undeterminable 


undeterminable 


8 


Medicaid Cluster 


Unallowable vocational and social 
services 


✓ 






















■/ 


undeterminable 


undeterminable 


9 


Medicaid Cluster 


Prescription co-payment not charged 
and amounts overpaid for 


























$8 


$251,141 


10 


Medicaid Cluster 


IT policies and controls inadequate 


✓ 


✓ 


























11 


Medicaid 
Cluster/SCHIP 


Eligibility controls inadequate 










✓ 










■/ 






$5,111 


$5,141,774 


12 


Medicaid Cluster 


Cost of Care not deducted from 
payments to nursing home providers 




✓ 






















$117 


$3,575,587 


13 


Medicaid Cluster 


Inadequate control system over 
multiple authorized rates 


























$23 


$503,957 


14 


Medicaid Cluster 


Lack of procedures to address 
Medicaid recipient fraud 




✓ 




















■/ 






15 


Medicaid Cluster 


Re-determinations not timely 






























16 


Medicaid 
Cluster/SCHIP 


IEVS data exchange noncompliant 










✓ 




















17 


Medicaid 
Cluster/SCHIP 


Client eligibility determinations 
incorrect and differing between 






























18 


Medicaid Cluster 


MaineCare client counts inconsistent 
and not replicable 










✓ 




















19 


Medicaid 
Cluster/SCHIP 


OMS unauthorized approval of non- 
timely filing 














✓ 
















20 


Medicaid Cluster 


Third Party Liability collections 




















✓ 










21 


Medicaid Cluster 


Medicaid financial reports do not 
satisfy requirements 




















■/ 










22 


Medicaid Cluster 


HCBS Waiver annual report data can 
not be verified 




















V 
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2006 Summary of Medicaid and SCHIP Audit Findings 



No. 


Federal Program 


Description 


Activities Allowed 


Allowable Costs 


Cash Management 


Davis-Bacon Act 


Eligibility 


Matching, Level of Effort, Earmarking 


Period of Availability 


Procurement and Suspension and Debarment 


Program Income 


Reporting 


Subrecipient Monitoring 


Special Tests 


Known 

Questioned 

Costs 


Likely 

Questioned 

Costs 


23 


Medicaid Cluster 


Incorrect coding of crisis intervention 
services 
























✓ 






24 


Medicaid Cluster 


Inadequate follow-up in cases of 
possible fraud 
























✓ 






25 


Medicaid Cluster 


Program integrity and surveillance 
and review 
























✓ 






26 


Medicaid Cluster 


Claims processing and information 
retrieval system deficient 
























✓ 






27 


Medicaid Cluster 


Inadequate security controls in Oracle 
Financials 
























✓ 






28 


Medicaid Cluster 


Noncompliance with ADP review 
requirements 
























✓ 






29 


Medicaid Cluster 


Individual Care Plan authorized 
services incomplete 
























✓ 






30 


Medicaid 
Cluster/SCHIP 


Medicaid prescription drugs and 
supplies 
























✓ 


$11 


$329,009 


31 


Multiple programs 


Inadequate cost allocation plan 




✓ 






















undeterminable 


undeterminable 


32 


Multiple programs 


Inadequate controls over allocated 
cost journals 




✓ 






















$2,129,301 


undeterminable 


33 


Multiple programs 


Inadequate controls over federal 
matching requirements 


























undeterminable 


undeterminable 


34 


Multiple programs 


Inaccurate SEFA reporting 




















■/ 










35 


Multiple programs 


Inadequate controls over federal cash 
management 






























36 


Multiple programs 


Inadequate controls over the 
administration of federal funds 


✓ 


















■/ 










37 


Multiple programs 


Inadequate support for the federal 
cash transaction reports (PSC-272) 




















S 










38 


Multiple programs 


Excess working capital 




✓ 






















$15,800,000 


$15,800,000 



Total 11 10 207110080 11 $18,105,638 $37,387,488 

Information Systems Audit Findings 

3 Insufficient claims payment controls 

10 Information technology contracts insufficient and IT policies and controls inadequate 
12 Cost of Care not deducted from payments to nursing home providers 

16 State Income and Eligibility Verification System (IVES) data exchange noncompliant 

17 Client eligibility determinations incorrect and differing between systems 

18 Reported client counts inaccurate 

25 Controls do not ensure adequate program integrity and adequate surveillance and review 

26 Claims processing and information retrieval system deficient 

27 Inadequate security controls in Oracle Financials 

28 Noncompliance with Automatic Data Processing (ADP) review requirements 



Note: Equipment and Real Property 
Management and Real Property 
Acquisition compliance areas are not 
listed as there were no findings in these 
categories. 
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Intake/Application Data: Q] through (5): 



(1) Personal li iu tii Ui on, name, SSN, DOB, etc. 

(2) Financial IrriurrvbJion, income, assets 

(3) Non-Financial Irtfurrvktion, age, household, etc 

(4) SS/VSSI Client Status, recipient or beneficiary. 

(5) Disability Assessment if applicable. 




AUDITOR NOTE: 
AFDC Criteria: 
Maine State Plan for AFDC, 

dated 7/16/1996 
Criteria is the Basis for many 
Family Related MaineCare 
Eligibility based on AFDC 
eligibility. 



Eligibility 

System (ACES) 

CVnen OAS 




NavEn^and Child 
Support Ei fore st i b t 
System (NECSES) 

Omar. OIAS 



On-ER EXTERNAL SYSTEMS: 

Tw>Way Interfaces or One-V\jay 
Data Transrrissions 
Owners: 
IEVS (SSA, IRS); DOL, DMV, IFW, 
DMR, etc. ^ 





AUDITOR NOTE: 
AFDC Criteria: 
Maine State Plan for AFDC, 

dated 7/16/1996. Criteria is 
the Basis for some Title IV-E 
eligibility requirements. 



Maine Automated Child 
VNfeHare Inforrroation 
System (MQCVUS) 

Ouner OCFS 



Intake/Application Data: (1) through (5): 

(1) Personal li ftj i mi on name, SSN, DOB, etc. 

(2) Financial Irfbrmation income, assets 

(3) Non-Financial Information, age, household, etc. 

(4) SSA/SSI Client Static, recipient: or beneficiary. 

(5) Disaldlity Assessment if applicable 



CLIENT ELIGIBILITY DATA FLOW 



Electronic Benefits 
Transaction (EBT) 
TANF S< Food Starrps 
Owner: CHAS 



AdJt Mental Health 
Tracking System 
Owner QAMHS 



DHHS Client Data from Eligibility Systems to 
Payment Systems, September 2006 





MaineCare Point of 
Purchase System 
(MEPOPS): Pharmacy 
Payments 
Owner: QMS 



IT PROCESS : ACES Client Eligibility Determination for 
the Major DHHS Programs. 

(1) Typically, client information is initially entered directly 
into ACES by OIAS caseworkers to determine what major 
DHHS programs an individual may is eligible for. 
Information from other DHHS systems, such as NECSES, 
and other external IEVS (Income & Eligibility Verification 
Systems) transmissions from the SSA, IRS, and DMV are 
added to this data in ACES and the eligibility process is "run' 
is ACES. 

(2) For some SSI related cases, however, eligibility is 
determined automatically in ACES resulting only from 
externally received client data transmissions. 

(3) Data pertaining to client eligibility status is sent to 
WELFRE for recipient aid category (RAC) code assignment. 



LEGEND 

^ = communication or interface of client eligibility data from the Eligibility Systems 
= communication or interface of client eligibility data to the Payment Systems 

^ = information used for client eligibility determination / case management process 
= QMS managed client data information used for claims adjudication / payment 



IT PROCESS : MACWIS Client Eligibility Determination 
for Title IV-E and Other Office of Child and Family 
Services (OCFS) programs. 

(1) Both, the MACWIS and OCFS personnel use client 
information to determine if individuals are eligible for federal 
IV-E Foster Care, IV-E Adoption Assistance or other State 
funded OCFS programs. Client data is entered directly into 
MACWIS by OCFS caseworkers, and other DHHS 
personnel, but is also the result of many internal and external 
exchanges of system information. If the OCFS eligibility 
specialist comes up with a result different than MACWIS, 
relevant information is reviewed for accuracy to determine 
which assessment was correct. Any required changes are 
made accordingly. (2) Data pertaining to client eligibility 
status is sent to WELFRE for recipient aid category (RAC) 
code assignment. 



IT PROCESS : WELFRE Receipt and Disbursement of Client Eligibility Data to 
Payment Systems. WELFRE assigns RAC codes to each individual case using 
Bull Interface programming. Payment systems use these RAC codes to assign 

federal and State funding sources to claims during the adjudication process shown 
on P-IS-1 .2. This information is forwarded to MFASIS for the payment of claims. 



PAYMENT DATA FLOW 



MEPOPS: 
Pharrracy 
dairrs 



CLAIM 
PROCESSING: 



MECMS: 
Non-pharrrBcy 
dairrs 



Provider : 

Submits 
claim 





Claims Data flow among the Payment and 
Accounting Systems, October 2006 



IT PROCESS : CLAIMS 
PROCESSING 
LIFECYCLE: 

(1) Claims cleared for 
payment move on to have 
proper accounting applied 
for expenditure record 
classification through the 
Permissions Matrix 
and ORACLE Financials 
(OFIN) . 

(2) Claims that successfully 
make it through OFIN are 
rolled into one transaction 
for each provider/vendor 
that is passed on to the 
Maine Financial & 
Administrative Statewide 
Information System 
(MFASISl 



STATE CHILDREN'S INSURANCE PROGRAM 



(1) 

Finding Title: Estimated expenditures reported 
Prior Year Finding: No 
CFDA: 93.767 

CFDA Title: State Children's Health Insurance Program (SCHIP) 
Federal Award: 05-0405ME5021 

Federal Agency: U.S. Department of Health & Human Services 

State Department: Department of Administrative and Financial Services (DAFS) 

Bureau: Health and Human Services Service Center (H&HSSC) 

Finding Type: Internal control and compliance 

Compliance Area: Reporting 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 

• Attachment A, Subpart C (Basic Guidelines) of OMB Circular A-87, Cost 
Principles for State, Local and Indian Tribal Governments 

• 42 CFR §457.630(4)(e)(l) and (2) 

Condition: The Department of Administrative and Financial Services' Health and 
Human Services Service Center (H&HSSC) reported $1.1 million in "estimated" 
administrative costs as "actual" expenditures on the program's quarterly expenditure 
reports for the period 7/1/05 through 6/30/06. H&HSSC representatives signed the 
reports, which require them to certify to the best of their knowledge and belief that 
"expenditures included in the report are based on the State's accounting of actual 
recorded expenditures, and are not based on estimates." 

Context: H&HSSC placed reliance on a consultants' study, which identified additional 
potentially allocable "budgeted" costs. The Program has a 10% cap on administrative 
costs; H&HSSC subtracted administrative costs actually incurred from the cap amount 
available and then added estimated costs equivalent to the remaining cap amount. 

Cause: H&HSSC did not determine what actual costs were incurred in the areas 
identified by the consultant but assumed costs to have been incurred. 

Effect: H&HSSC claimed federal reimbursement in excess of the charges that it could 
support; however, a questioned cost was not developed as H&HSSC was subsequently 
able to identify more than $1.1 million in allowable administrative costs that could be 
claimed in lieu of the reported "estimated" amounts. Section 3.1 of the SCHIP State plan 
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STATE CHILDREN'S INSURANCE PROGRAM 



allows Maine to claim health services initiatives' (HIS) costs under the State's 10 percent 
administrative cap. 

Recommendation: We recommend that the Health and Human Services Service Center 
only claim "actual" expenditures on the programs' quarterly expenditure report. 

Management Response/Corrective Action Plan: The Department of Administrative and 
Financial Services, Health and Human Services Service Center agrees with this finding. 

Beginning July 2007, actual expenditures will be recorded on the program's quarterly 
reports instead of the consultant' s spreadsheet. Also, this step will be added to the 
procedures documentation for the CMS 21 report. 

Contact person: Chuck Bryant, DAFS, DHHS Service Center - Financial Analyst, 287- 
3171 
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MEDICAID CLUSTER 



(2) 

Finding Title: Program integrity reviews show over billing of waiver costs 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs 

Known Questioned Cost: $130,912 ($206,485 x .634 blended federal financial participation 
rate) 

Likely Questioned Cost: Undeterminable 

Criteria: MaineCare Benefit Manual (Chapter I and Chapter II, §21) 

Condition: Home and Community Based Services Waiver (Waiver) providers do not have 
sufficient records to support MaineCare invoices. To date, the DHHS Program Integrity Unit 
(PIU) has reviewed four providers, each was issued a recoupment letter. 

Waiver client reimbursement rates are based on provider budgeted costs. PIU cited the agencies 
for the following: 

• Not incurring or overstating budgeted costs, including having fewer staff than budgeted 

• Billing unallowable costs, including personal expenses 

• Lacking documentation to support services billed 

• Billing for more units of service than actually provided 

Context: The PIU examined four providers during fiscal year 2006 and recommended 
significant recoupments for each of these providers. One of the four has agreed to repay 
$206,485 for one client. The other three providers, who were requested to repay from $56,518 to 
$539,310 for one or more clients, are in various stages of the appeal process. 

According to one national organization, Maine's average Waiver cost of approximately $79,000 
is about twice the national average. During fiscal year 2006, the Medicaid Home and 
Community Based Services Waiver Program expended $242 million. 

Cause: Financial monitoring has been insufficient. The program has not compared providers' 
actual costs to their estimated costs, nor controlled costs by adjusting rates accordingly. 
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MEDICAID CLUSTER 



Effect: Medicaid costs are higher than necessary. Providers receive payment based on their 
estimated costs; if estimated costs are not incurred or are overestimated, the providers receive 
excessive payments. 

Recommendation: We recommend that the Department establish financial accountability over 
Waiver expenditures by basing its payments on actual costs. We also recommend that the 
Department provide the Program Integrity Unit sufficient resources to expand their examination 
capabilities. We note that the Department is moving from negotiated rates to a published rate 
payment structure. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the rate recommendation in this finding. 

The Department is moving toward a published rate system. The rates have been developed 
though an extensive analysis of cost data and have used this data to set reasonable rates. It is 
anticipated that these rates will be effective in the second quarter of fiscal year 2008. 

Contact: Jane Gallivan, DHHS - Program Systems Director, 287-4212 
(3) 

Finding Title: Insufficient claims payment controls 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 

Finding Type: Internal control and compliance 

Compliance Area: Activities allowed or unallowed 

Known Questioned Cost: $12,173 ($19,200 x .634 blended federal financial participation rate) 

Likely Questioned Cost: Undeterminable 

Criteria: 

• 42 CFR §433.10- §433.131 - Medicaid claims management system requirements 

• U.S. Department of Health & Human Services Understanding Medicaid Home and 
Community Services: A Primer. 

Condition: The Medicaid Claims Management System (MECMS) has insufficient edit and limit 
checks to control Waiver expenditures and to provide assurance that only authorized payments 
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MEDICAID CLUSTER 



are made. MECMS and the Enterprise Information System (EIS) are not fully integrated and do 
not allow administrators to easily manage or monitor program activity. 

MECMS will not prevent providers from front- loading or billing early. A test of payments made 
for six clients showed that one provider's weekly invoices for two clients were for more units of 
service than the authorized average. We requested a MECMS query of all similar payments for 
those clients, for that service code, to that provider. The query showed that the provider billed 
the system's weekly maximum number of hours until reaching the entire amount authorized for 
the year. The provider stopped billing by March, when the units of service reached the clients' 
annual authorized service limit, although service continued through June. Although the provider 
did not bill more than the total authorized, the claims payment system would not have prevented 
it. We obtained client service documentation showing that all services billed were provided, 
although the number of service units was much higher than that on which the rate was 
established. 

MECMS will not prevent over billing. We further tested this internal control weakness by 
judgmentally selecting two other clients of other providers for whom payment rates had been set 
based on fewer units of service than the system limit. We requested queries of all payments for 
that service code, for those clients, to those providers. Our testing was limited as the queries, 
although straightforward, are time-consuming. They require manual processing through multiple 
screens; the requested query took experienced Department staff approximately two days. One of 
the two providers overcharged the program. The provider billed the maximum number of units of 
service that the system will process; thereby charging $19,200 more than authorized, and more 
than the provider's estimated costs. We note that the client was initially authorized 350 days 
annually at a rate of $241.83. Halfway through the year the annual days authorized were reduced 
to 305 days and the rate increased to $444.17 per day. The provider actually billed for 363 days, 
at the billing rates in effect at the time. 

Context: The Waiver program has set its rates to cover provider estimated costs: the rate per unit 
of service is dependent on how many units are authorized over any given period. If fewer units 
are authorized the rate per unit is higher; if more units are authorized, the rate is lower. Although 
the provider's annual cost is to some extent driven by the services that clients require, the 
providers' estimated costs are allocated to whatever the number of units is. The number of units 
and the rate per unit are somewhat arbitrary and function primarily as a billing mechanism. Most 
clients receive services year round even though the number of units authorized is often less than 
that. 

Cause: Once payment rates have been established, MECMS generally processes claims without 
human intervention. For Waiver code W125, Personal Support Services, the only system limit is 
the weekly maximum number of units that will be paid (168 hours = 7 days X 24 hours). It has 
no edit or limit checks to ensure that providers do not bill for more than the total dollars or units 
authorized on a weekly, monthly or annual basis. 

Current information systems do not facilitate program management and oversight. MECMS was 
placed in operation in January 2005; it has limited reporting capacity. The associated Maine 
Medicaid Decision Support Services database, which summarizes information for reporting, has 
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not worked. Program personnel also use EIS to manage and administer the Home and 
Community Based Services Waiver program. Although much program information, including 
units of service and individual client payment rates, is entered into EIS, actual claims payment 
information does not flow back from MECMS to EIS, but must be obtained by other means. 

Effect: The rate structure may result in: 

• Approved total annual payments being made sooner than authorized 

• Units of service provided may not be billed 

• Service units may be billed for more than the annual amount authorized 

The intent is that the program cover the providers' estimated annual costs but when units are set 
artificially low, providers may overcharge. We question the federal portion of the excess amount 
billed (18%), $12,000. It was not possible to project likely questioned costs because of the 
number of variables involved. 

Recommendation: We recommend that the program: 

• Authorize annual/weekly units of service that correspond to those actually required. 

• Periodically monitor providers to prevent overbuying and unauthorized early billing. 

• Incorporate edit or limit checks to restrict payments to total annual units or dollars 
authorized. 

• Include actual payment data in EIS to facilitate program management. 

• Recover any overpayments. 

Management Response/Corrective Action Plan: The Department agrees with the 
recommendations. 

1. The Department's new Published rate system has specific authorizations based on the 
member's need. 

2. Currently, DHHS and OIT are planning to develop a set of computer programs that will 
capture over-billing information after the fact and allow for recovery. The timeframe for 
beginning the development of these programs is targeted for spring 2008, based upon current 
priorities. 

3. DHHS and OIT will review edits and limit checks and its ability to restrict total annual dollars 
authorized. If this is not easily fixable within MECMS, then this issue will be addressed during 
the implementation of the Fiscal Agent. 

4. DHHS and OIT are also planning to develop a set of computer programs, as part of EIS, that 
will match claim information to data within EIS; allowing for better program management. The 
timeframe for beginning the development of these programs is targeted for summer 2008, based 
upon current priorities. 

5. The Division of Program Integrity is currently involved with recovering overpayments as they 
obtain this information. 

Contact: Jim Lopatosky, DAFS/OIT/DHHS - Information Technology Director, 287-1921 
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(4) 



Finding Title: Inadequate financial accountability-payment rates not supported and include 

unallowable costs 

Prior Year Finding: 05-57 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs/Cost principles 

Known Questioned Cost: Undeterminable 

Likely Questioned Cost: Undeterminable 

Criteria: 

42 CFR §441.302 (b) Financial accountability 

U.S. Department of Health & Human Services, Understanding Medicaid Home and 
Community Services: A Primer 

42 CFR §441.310 Limits on Federal Financial Participation (FFP) 
MaineCare Benefits Manual §21.05-1 



Conditions: The Home and Community Based Services Waiver Program (Program) does not 
have adequate internal controls to ensure financial accountability for program expenditures. The 
Program established payment rates that were not supported, varied widely, were changed to 
cover provider costs, and included unallowable costs. In our sample of 60, we noted the 
following: 

Unsupported rates: 

The Program did not have provider budgets to support rates established for ten of 24 (42%) 
of Residential Training clients sampled and eight of 29 (28%) of Personal Support Services 
clients. 



Rates are not uniform and change: 

The Program can pay markedly different rates for the same client, depending on who their 
provider is, what the provider includes for estimated costs, and whether that provider has 
other client vacancies. If the numbers of clients serviced by a provider change, program 
personnel adjust rates paid for one or more of the remaining clients. 
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Unallowable Administrative Occupancy Costs: 

Thirteen of 14 (93%) of the Residential Training budgets received and 15 of the 21 (71%) 
Personal Support Services budgets included unallowable costs for administrative occupancy. 

Unallowable Start-Up Costs: 

One of the 21 (4.8%) Personal Support Services provider budgets included unallowable costs 
for furnishings and equipment/capital. This provider operates multiple facilities, all of which 
can be expected to have similar, unallowable costs. 

Unallowable Transportation Costs: 

For eleven of 21 (52%) budgets for personal care services (personal support services) for 
clients, the program set payment rates based on provider budgets that included transportation 
costs, which are unallowable for personal support services clients. 

Context: We examined three Waiver categories of service, which together account for 
approximately 90% of Program expenditures. Budgeted expenditures for these service categories 
were approximately $237 million. 

Cause: 

• The Program never obtained or compared actual provider costs to budgeted provider 
costs or adjusted its rates accordingly. 

• The Program established payment rates for large providers by using a "negotiated rate 
method" based on specific providers' expected service costs supported by annual 
budgets. 

• There is no documentation to support rates for smaller providers. The Program rates were 
based on "whatever was acceptable to the provider" and stayed the same until the 
provider requested a change. 

• Individual regional resource coordinators who approved the rates do not have accounting 
or finance backgrounds. 

• There was limited central oversight of the coordinators that approved rates. 

• The Program's interpretation of allowable costs included unallowable costs such as 
administrative occupancy costs. 

• Unallowable room and board costs are included in approved rates. 

Effect: State and federal funds have been expended for services that, to some unknown extent, 
were not allowable. The Program could not support its determination of rates that resulted in 
budgeted expenditures of $39.9 and $32.8 million. 

Known questioned costs were not determinable since provider costs are based on provider 
estimated costs rather than actual costs. Likely questioned costs cannot be projected since known 
questioned costs are not determinable. 

Recommendation: We recommend that the Program establish consistent, equitable rates that are 
based on only allowable, actual costs. 
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DHHS indicated that it intends to remove these unallowable costs for rates implemented in 
January, 2007. The Program is moving to a published rate system that should provide more 
consistent and equitable treatment of all providers and clients. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

The Department is moving to a standardized rate system, whereby providers receive the same 
rate for the same service. Additionally, the Department has removed all room and board costs 
from the standardized rates and will pay for those costs with State general funds appropriated 
from the legislature for this purpose. 

Contact: Jane Gallivan, DHHS - Central Office - Program Systems Director, 287-4212 
(5) 

Finding Title: Unallowable targeted case management charges to Medicaid 

Prior Year Finding: 05-55 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Department of Administrative and Financial Services (DAFS); Department 
of Health and Human Services (DHHS) 
Bureau: Office of Child and Family Services (OCFS) 
Health and Human Services Service Center 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs/Cost principles 

Known Questioned Cost: $27,870 (31 unallowable claims at $899.02 each) 

Likely Questioned Cost: $10.6 million ($20.3 million multiplied by a 52% error rate, or 31 
unallowable claims of 60 tested) 

Criteria: 

OMB Circular A-87; 42 USC §1396n(g)(2) 
Medicaid State Plan 

Condition: DHHS does not have adequate procedures in place to identify allowable targeted 

case management services to foster care clients. 

• DHHS has not provided cost information to support rates charged for targeted case 
management services provided directly by DHHS. Therefore, it is not possible to 
determine the appropriateness of those federal charges, which for fiscal year 2006 were 
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approximately $35 million. DHHS states that the rates have been verbally approved by 
the federal government. Representatives from the U.S. Department of Health and Human 
Services, Office of the Inspector General state that it is the methodology for deriving the 
rates that is approved, not the actual rates. 

• The Maine Automated Child Welfare Information System (MACWIS) generates targeted 
case management claims to Medicaid based on information entered. MACWIS log entries 
do not distinguish between Medicaid allowable case management and Title IV-E Foster 
Care and other non-Medicaid reimbursable services. 

• Multiple targeted case management claims can be generated by a single home visit if a 
caseworker copies a client log entry into the records of other children in the household, 
which could result in duplicate claims being paid for a family with several children. 

• Billing policies for case management services are inconsistent. The Office of Elder 
Services (OES) generates a Medicaid claim for a minimum of one half hour of client 
services whereas the OCFS generates a claim for only 15 minutes. 

• State matching costs for case management are based on calculations, not actual costs. 

• OCFS methods used to charge Title IV-E for case management and Medicaid case 
management are inconsistent and could result in overbilling. Case management services 
are billed to Title IV-E based on a pro-rata share of caseworker time, whereas Medicaid 
is charged based on a monthly rate per client. 

• OCFS and the OES do not have adequate controls in place to reconcile claims paid with 
claims submitted to the Office of MaineCare Services (OMS) for reimbursement. 

Context: In fiscal year 2006, the total State and federal share of targeted case management 
expenditures was approximately $93 million. Of this amount, Medicaid paid DHHS 
approximately $50 million with the remainder paid to other providers. Of the $50 million, 
approximately $35 million was reimbursed by the federal government. 

Of the 60 TCM claims from OCFS that we tested, 31 (52%) of the caseworker files document 
activities (such as making arrangements for visitation) that constitute normal caseworker services 
rather than special arrangements for services to clients eligible for the Title IV-E programs. We 
also note that the U.S. Department of Health and Human Services, Office of Inspector General 
has audited targeted case management; its final report has not yet been released. 

Cause: DHHS has not given adequate consideration to the guidance provided by the Centers for 
Medicare and Medicaid Services (CMS); and has not sufficiently defined or made a distinction 
between targeted case management services and direct Title IV-E case management services. 

Effect: Medicaid funds may be expended for unallowable costs resulting in current and future 
questioned costs. If DHHS did not incur matching costs it will result in questioned costs. 

Recommendation: We recommend that the Department: 

• Work with CMS to resolve all issues to the satisfaction of CMS with respect to billing for 
case management services and adequately document all policies and procedures 

• Establish consistent policies and procedures in regards to billing for case management 
between State agencies 
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• Ensure that computer systems involved in tracking case management have the necessary 
controls in place to adequately distinguish chargeable TCM from case management not 
billable to Medicaid 

• Document its expenditures of State funds to match the federal participation 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services disagrees with the questioned costs. 

The Office of Child and Family Services performs case management services. It is considered 
targeted because it is provided to a target population, not because it is something other than 
"direct case management". The Health Care Financing Administration (HCFA) agreed to our 
current TCM rate in 1996. Representatives of Maine's DHHS met with officials of HCFA in 
Boston on or about 2/29/96 to discuss Medicaid reimbursement for TCM services. As a result of 
the discussion, the Department and HCFA agreed upon a Medicaid reimbursement rate for TCM 
services. The Department subsequently submitted bills to HCFA for TCM services as agreed 
upon and HCFA issued payment to DHS/DHHS in accordance with the terms of the 1996 
agreement. Having said that, effective July 2006, DHHS has developed a new rate methodology 
as detailed in the OCFS cost allocation plan, whereby a Random Moment Time Study (RMTS) is 
used to determine what percentage of allowable costs is billed to Title IV-E. The remainder is 
built into the TCM rate that can be charged to Medicaid. The calculation will be total 
expenditures related to caseworkers and their work, including office and supervision overhead, 
multiplied by the percentage defined by the time study. The calculation will be done quarterly, 
giving the department a monthly billable rate. It should be noted that the RMTS only establishes 
the TCM rate; it is not used for billing purposes for individual claims. Billing for TCM is done 
on an individual monthly basis that is case specific for Medicaid eligible clients only. The 
evidence to support individual monthly TCM claims is documented in the MACWIS narrative 
log. 

During fiscal year 2008, the TCM rate was reduced from $899 to $735.83. 

Because the definition was admittedly ambiguous, Congress recently amended the definition of 
an appropriate Targeted Case Management Service claimable under Medicaid in Section 6052 
of the Deficit Reduction Act of 2005 ( DRA ) - Reforms of Case Management and Targeted Case 
Management. As a result, effective January 2006, Maine no longer bills Medicaid for TCM 
services to children who are Title IV-E eligible. 

Contact: Kirsten Figueroa, DHHS - Deputy Commissioner of Finance, 287-1921 

Auditor's Conclusion: We disagree with management's response for the following reasons: 

We concur, as DHHS states, that the rate that it is currently charging for targeted case 
management dates back to 1996. However, we believe that DHHS has not adequately considered 
later federal guidance. The Centers for Medicare & Medicaid Services (CMS) issued a State 
Medicaid Director Letter (SMDL#01-013) dated January 19, 2001. The letter urges states to 
"undertake a careful review to ensure the activities to be claimed under Medicaid meet the 
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definition of case management and are not directly connected to the delivery of foster care 
benefits and services." 

The finding remains as stated. 



(6) 

Finding Title: Noncompliance and inadequate internal control over Medicare Part B eligibility 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Office of Integrated Access and Support 

Office of MaineCare Services 

Financial Management Services 

Finding Type: Internal control and compliance 
Compliance Area: Eligibility 
Known Questioned Cost: $112 

This is the federal portion of two Medicare Part B insurance premiums paid by the State for 
Medicaid ineligible persons, (two individuals at $88.50 each at a federal participation rate of 
63.4%) 

Likely Questioned Cost: $1,186,020 

This was computed by applying the sample error rate of 3.33% to the population of federal 
expenditures for Medicare Part B insurance ($35,616,230). 

Criteria: 

• 42 CFR §431.625 

• MaineCare Eligibility Manual, Chapter 332, Appendix (3-1) 

Condition: DHHS charged the Medicaid program for Medicare Part B premiums for individuals 
who were not eligible or who were identified as ineligible. Of the 60 individuals included in our 
test, DHHS automated eligibility systems showed that five were not eligible. However, once 
individual case histories for the five were researched, only two of the five, or 3.33% of the 60 
sampled were not eligible. 

Context: In fiscal year 2006 DHHS paid $56.1 million to the Centers for Medicare and Medicaid 
Services for Medicare Part B coverage. 
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Cause: DHHS made the monthly payments without comparing the identities of the insured to the 
State's Medicaid eligibility records. For the three individuals who the system showed ineligible 
in error, two incorrect assessments were due to problems with data exchange between internal 
eligibility systems and one to case worker error. 

Effect: Medicaid costs are higher than necessary. DHHS has paid premiums for ineligible 
individuals. Projections of the results of our sample indicate that as much as $.7 million from the 
General Fund and $1.2 million of federal funds could have been saved in fiscal year 2006. 

Recommendation: We recommend that the Department develop electronic matching procedures 
to ensure that payments are made only for eligible individuals. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the finding. 

The Department agrees that we do need to perform regular reconciliations of what CMS bills the 
State of Maine for Buy-In recipients in order to verify accuracy in the payment process. The 
reconciliation will identify those individuals eligible for payment and those that are not. The 
Department plans to have the reconciliation in place by December 2007 and will perform the 
reconciliation every 6 months in order to maintain payment accuracy. 

Contact: Tom Keyes, DHHS - Office of Integrated Access and Support (OIAS), Deputy Director, 
287-2310 



(7) 



Finding Title: Controls insufficient to prevent unallowable waiver transportation costs 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 



Finding Type: Internal control and compliance 
Compliance Area: Activities allowed or unallowed 
Known Questioned Cost: Undeterminable 
Likely Questioned Cost: Undeterminable 
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Criteria: 

• Application for a § 1915 (c) Home and Community-Based Waiver [version 3.3] - 
Instructions, Technical Guide and Review Criteria 

■ Appendix C, Attachment: Core Service Definitions - B-3. Non-Medical 
Transportation) 

• State Organization and General Administration, Assurance of Transportation (42 CFR 
§431.53) 

• Services: General Provisions, Transportation (42 CFR §440. 170(a)) 

Condition: The Department of Health and Human Services does not ensure that the Waiver 
program does not pay for medical transportation services that are required to be provided by the 
Medicaid State Plan. According to federal technical guidance, non-medical transportation 
services are allowed under the Waiver program. However, medical transportation services 
required by the general Medicaid requirements (provided under the State Plan) shall not be 
charged to the Waiver program. We found instances where client Individual Care Plans 
indicated that all transportation needs, including to medical appointments, were provided by the 
Waiver provider. 

Context: Twenty of the sixty Individual Care Plans examined stated that all transportation needs, 
including to medical appointments, were provided by the Waiver provider. Payment rates for 
waiver services generally have been based on budgets that included funding for transportation. In 
many cases, providers' budgets include purchase of vehicles. We do not question costs as 
transportation costs are built into provider rates and some transportation costs are allowable 
Waiver charges. 

Cause: Program personnel indicated that they have guidelines to limit the transportation costs 
that providers can build into their facility budgets but there is no apparent control in place to 
limit vehicle use to non-medical transportation. As vehicles are available, they appear to be used 
to meet all client needs including medical transportation. 

Effect: The Waiver program is not compliant with the federal requirements regarding 
transportation charges. 

Recommendation: We recommend that the Department advise providers that medical 
transportation must be billed separately and that it structure rates so that those costs are not paid 
with Waiver funds. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the finding. The Department will continue to inform Providers to bill State 
Plan services for medical transportation. 

The new published rates include transportation to non-medical services only. It must be 
recognized that there is limited availability of on-demand transportation services. The waiver 
program provides services on a 24/7 basis. In virtually all areas of the State, capacity to provide 
State plan transportation service does not exist. The priority of waiver services is to always 
provide for the health, welfare and safety of the program's participants which necessitates 
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availability of transportation services on very short notice. The Department will develop a 
process to document the refusal, denial or unavailability of State plan transportation services for 
medical transportation in order to monitor the waiver program. 

Contact: Jane Gallivan, DHHS - Program Systems Director, 287-4212 



(8) 

Finding Title: Unallowable vocational and social services 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 

Finding Type: Internal control and compliance 

Compliance Area: Activities allowed or unallowed 

Known Questioned Cost: Undeterminable 

Likely Questioned Cost: Undeterminable 

Criteria: 

• MaineCare Benefits Manual, Home and Community Benefits for Members with Mental 
Retardation, Non-covered Services (§21.07) 

• Application for a §1915 (c) Home and Community-Based Waiver [version 3.3] - 
Instructions, Technical Guide and Review Criteria 

■ Appendix C, Attachment: Core Service Definition - 8. Day Habilitation 

■ Appendix C-3: Waiver Services Specifications - G. Prevocational and Supported 
Employment Services 

Condition: The Department of Health and Human Services has included unallowable vocational, 
recreational and social services in clients' Individual Care Plans (ICPs). According to federal 
technical guidance, waiver funding is not available for the provision of vocational services (e.g. 
sheltered work performed in a facility) where individuals are supervised in producing goods or 
performing services under contract to third parties. Additionally, waiver payments for day 
habilitation may not provide for services that are vocational in nature (e.g. sheltered work). The 
MaineCare Benefits Manual prohibits reimbursement of services provided to members of which 
the basic nature is to provide vocational, social, academic or recreational services. 
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Context: In our sample of 60 waiver client's ICPs, we found ten clients whose ICPs indicated 
unallowable sheltered work, employment by the day habilitation provider, or apparent social and 
recreational services. Examples of such unallowable services included the following: 

• One ICP identified the service authorized as Supported Employment rather than as it was 
budgeted as Day Habilitation. The worksite is a Certified Work Center where individuals 
are supervised in producing goods or performing services under contract to third parties. 
Such Work Centers constitute sheltered employment; the activity is neither Supported 
Employment, which is in a regular work setting, nor Day Habilitation; it is not an 
allowable use of Waiver funds. Budgeted annualized costs for this service were $12,977; 
the federal share would be $8,100. 

• A second ICP stated, "Some paid work as part of Day Services. . ." The client's budgeted 
annualized Day Habilitation costs were $16,926. 

• A third ICP included a description of activities that appeared to be predominately social 
and recreational services. 

• Some Waiver clients earn some money by "working" for the providers who provide them 
Day Habilitation services. It is not always clear that the funding for this work is from 
other than Day Habilitation funds. Likewise, care plan narratives sometimes lack clarity 
as to the basic nature and medical necessity of all activities in which clients are engaged. 

Cause: Narrative descriptions are not specific as to the exact nature of activities engaged in, the 
allowability of the activity for Medicaid funding or, if the activity is not funded by Medicaid, 
how it is funded. Unintentional miscoding of activities may also have occurred. 

Effect: Some services made available to Waiver clients may not have been allowable Waiver 
charges or may have been miscoded. There is a potential for unallowable costs and any 
miscoding distorts program reporting. 

Recommendation: We recommend that the Department personnel clearly describe the medical 
necessity of services provided, document any other funding sources for payments or services 
made to, or on behalf of, Waiver clients, and take due care to properly code the use of Waiver 
funds. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services partially agrees with this finding and offers the following as responses to the cited 
examples. 

Regarding sample number one the Department agrees, and the consumer authorization has since 
been changed to reflect the accurate delivery of the service category. 

With sample number two it is acknowledged that very limited remuneration occurred. This is not 
uncommon at a habilitation service site. Preparation for future employment is seen as 
habilitative and service plans often call for minor payment for contracted type work. In instances 
such as this the scope of work is limited and the day's events are primarily devoted to 
habilatative exercise that are not reimbursed. Often the total week's payment is $5.00 or less; it 
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is, however, the earning of this payment that greatly enhances the learning experience and 
develops pride in the events. 

Sample number three cites opportunities provided to the consumer that on paper appear to be 
recreational in nature. The detail of what occurs during a community outing is not described, but 
attending church or the local gym are mechanisms to skill building, such as knowing how to use 
unknown public facilities appropriately (locker, shower); health benefits from the exercise, 
social and spiritual health from attending and participating in a community activity. CMS 
interprets "an activity that may appear to be a recreational activity may be rehabilitative if it is 
furnished with a focus on medical or remedial outcomes to address a particular impairment of 
functional loss ". 

The Department cites these as examples of community inclusion exercise and opportunities that 
are invaluable to ones integration into the community, one of the highest goals and outcomes 
that the waiver support can offer. 

Contact: Jane Gallivan, DHHS - Program Systems Director, 287-4212 

Auditor's Conclusion: For the third sample, while we recognize that these activities may present 
a beneficial opportunity to the Waiver participant, Medicaid regulations state that the basic 
nature of a reimbursable activity cannot be social or recreational. 

The finding remains as stated. 



(9) 

Finding Title: Prescription co-payment not charged and amounts overpaid for prescription drugs 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Office of MaineCare Services 

Finding Type: Internal control and compliance 

Compliance Area: Activities allowed or unallowed, Allowable costs/Cost principles 
Known Questioned Cost: $1.60 + $6.40 = $8 

This is the federal portion ($1.60) of a co-payment that was not charged and the federal portion 
of two overpayments ($6.40) as referred to in the Condition section of this finding. 

Likely Questioned Cost: $47,089 + $204,052 = $251,141 
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The likely questioned cost amounts associated with co-payments and overpayments were 
computed by applying the respective error rates of .03% and .13% to the population of federal 
expenditures for prescription drugs ($156,963,014). 

Criteria: MaineCare Benefits Manual, Chapter II §80 

Condition: Three of 40 pharmacy transactions examined were paid incorrectly. In one instance 
the Department did not charge a member a standard MaineCare co-payment of $2.50; the 
transaction was not exempt according to the provisions of the MaineCare Benefits Manual, 
Chapter II §80. In two other instances, the Department paid the pharmacy more than the federal 
upper limit. Payments were made for $8.49 and $15.24 rather than $5.85 and $7.85. 

Context: The Medicaid program expended approximately $247.5 million for prescription drugs 
in fiscal year 2006. 

Cause: The payment errors were caused by errors in information contained in two electronic 
interface systems. With regard to the co-payment error, the prescription claims processing 
software received an electronic interface from the State's WELFRE system that incorrectly 
indicated that the member should not be charged a co-payment. The interface allowed an 
exemption for all members classified within a certain recipient aid category (1M). This is not 
consistent with State policy. With regard to the upper limit errors, the State's pharmacy claims 
processor relied on an electronic interface of data from an independent industry provider of drug 
information that contained incorrect information. 

Effect: Pharmacy costs were shifted from the member to the federal and State governments and 
costs were overpaid. 

Recommendation: We recommend that the Department review and correct the electronic rules 
governing member co-payments. We recommend that the Department compare the federal upper 
limit amounts in the claims processing database to the federal upper limit amounts issued by the 
Centers for Medicaid and Medicare Services; and make any necessary corrections. In addition, 
we also recommend that internal control procedures be established to ensure these amounts are 
correct on an ongoing basis. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

The Office of Integrated Services and the Office of MaineCare Services are reviewing the 
interface co-pay rules. The results of the review will be integrated into the interface to provide 
consistency with DHHS policies. The interface is targeted for completion in March 2008. 

The Department of Health and Human Services concurs with the recommendation of 
reviewing/comparing the federal upper limit amounts in the claims processing database to the 
federal upper limit amounts issued by the Centers for Medicaid and Medicare Services. DHHS 
will require a quarterly review of CMS - To Medispan - To GHS - federal upper limit amounts 
and make corrections of any discrepancies and will establish a procedure for random auditing of 
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the State FULs to the current CMS/ Medispan tape to monitor quarterly review effectiveness 
(anticipated implementation date: October 2007). 

Contact: Carol Bean, DHHS - Comprehensive Health Planner II, 287-3941 
(10) 

Finding Title: Information technology contracts insufficient and IT policies and controls 
inadequate 

Prior Year Finding: No 
CFDA: 93.775, 93.777, 93.778 
CFDA Title: Medicaid Cluster 
Federal Award: 05-0505ME5028, 05-0605ME5028 
05-0505ME5048, 05-0605ME5048 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services (DAFS) 
Bureau: Office of Information Technology (OIT) 

Systems for Office of MaineCare Services (OMS) 

Office of Integrated Access & Support (OIAS) 

Finding Type: Internal control and compliance 
Compliance Area: Special tests and provisions 
Known Questioned Cost: None 
Likely Questioned Cost: None 
Criteria: 

• 45 CFR §95.6 17(a) - Software and ownership rights 

• The State information security policy adopted by the Information Services Policy Board 
(5MSRA§1871-§1896) 

• Health Insurance Portability and Accountability Act of 1996 (HIPAA) - The HIPAA 
Security and Privacy Rules require all covered entities to protect the electronic protected 
health information that they use or disclose to business associates, trading partners or 
other entities. 

Condition: OIT personnel responsible for computer systems activities of DHHS have not 
established sufficient procedures to comply with State information security policies, which also 
results in noncompliance with HIPAA. Departmental IT security policies do not sufficiently 
address a number of security risks, including the following: 

• Third party system access 

• Network-to-network connections that allow multiple users or systems from a third party 
to interact with State resources (Type of access and reasons for access should be driven 
by a business need, which must be scrutinized by account management in accordance 
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with State policy. A complete record of access granted and its usage should be 
documented for monitoring purposes.) 

• Personnel screenings of prospective IT contractors who will be granted access to State 
Information Systems 

• User training to provide security awareness, and updates to security policies or 
procedures (A failure to adequately perform these activities would affect the reporting of 
incidents and vulnerabilities as well.) 

• Documentation of operating procedures and responsibilities for all information 
processing 

We note that the State contracted with a vendor on June 2, 2005 to develop and formally 
document all information security policies and procedures. 

• Internal controls over information security for MECMS are not operating effectively. 
DHHS has inappropriately assigned user privileges, including system level access, to 
vendors and has not adequately monitored them. Also, DHHS did not maintain 
documentation of system usage that would allow user activity to be reviewed on a regular 
and independent basis. 

• DHHS IT contractual agreements are inadequate to minimize risk to the State in the 
following areas: 

o State IT management authority over vendor activities performed 

o Competency of the vendor contractors performing the work 

o State ownership of script/coding and supporting documentation of new IT 

processes as produced 
o Access to script/coding for new IT processes held in escrow during the 

development phases 

o Monitoring of vendor activity and limiting vendor access to specific timeframes 
o Testing the effectiveness of new program functionality 
o Sufficient access to vendors 

Context: The State security policy was adopted by the Information Services Policy Board on 
December 19, 2002 to provide a uniform set of information technology security policies, 
standards and general guidelines for State government in accordance with 5 MSRA §§ 1871 - 
1896. This policy requires that agencies establish and document detailed procedures that provide 
assurance that prudent steps have been taken to ensure the integrity, confidentiality, and 
availability of information systems. 

Cause: Ongoing technical difficulties and frequent system enhancements related to DHHS 
programs have created pressure to resolve system problems in the shortest time possible. 

Effect: Insufficient IT policies have resulted in the following: 

• Noncompliance with information security guidelines 

• Inadequate procedures to address IT vendor failures to meet contractual obligations 

• The integrity, confidentiality, and availability of State information may be compromised 
for all IT systems administered by the Department 
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• The Department does not have ownership or documentation of all MECMS technical 
design plans and payment logic rules 

Recommendation: We recommend that the Department improve its information security 
policies and procedures. 

Management Response/Corrective Action Plan: Department of Administration and Financial 
Services, Office of Information Technology partially agrees with this finding. 

The audit finding suggests that OIT-DHHS does not have formal IT Security Policies or 
Procedures for its Automated Data Processing systems. OIT-DHHS had contracted with a 
vendor to interview all IT groups within DHHS and develop an enterprise-wide (DHHS) review 
of IT Security Polices and Procedures to ensure the Department is consistent with the State IT 
Security Policy. The deliverables for this project were completed in the fall of 2005. In 
December 2006, OIT-DHHS contracted with a vendor to review and augment the current 
Security Policies and Procedure documents to ensure compliance with HIPAA. Input has been 
received; however, the Department hasn't yet implemented all of the suggestions. 

In fiscal year 2008, OIT-DHHS will work to develop an approach that ensures a DHHS-wide 
report on application systems. The report will include the following components for 
applications: 

A. Physical security; 

B. Equipment security; 

C. Software and data security, including periodic penetration testing; 

D. Telecommunications security; 

E. Personnel security; Contingency plans; 

F. Emergency preparedness; and 

G. Designation of an Agency ADP Security Manager( s ) 

In order to balance workload, it is envisioned that reviews will happen for half of the 
applications in one fiscal year, the other half in the second. The feasibility of this report will 
consider the DHHS IT Security policy, the IRS Safeguard Review, and SSA Review. The 
approach and plan will be developed by January 31, 2008. The schedule for implementing this 
plan will be included in the January 31 st deliverable. 

Contact: Brian Guerrette, DHHS/OIT/DAFS, Systems Section Manager, 287-1748 

Auditor's Conclusion: While the Department has recognized the need for compliant policies and 
procedures, it has not yet implemented all necessary procedures nor documented them. The 
finding remains as stated. 
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(11) 

Finding Title: Eligibility controls inadequate to ensure that payments are made from the 

appropriate program for only eligible individuals 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 and 93.767 

CFDA Title: Medicaid Cluster 

State Children's Insurance Program (SCHIP) 
Federal Award: 05-0505ME5028, 05-0605ME5028 
05-0505ME5048, 05-0605ME5048 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Department of Administrative and Financial Services (DAFS) 

Department of Health and Human Services (DHHS) 
Bureau: Office of MaineCare Services (OMS) 

Office of Integrated Access & Support (OIAS) 
Office of Information Technology (OIT) 

Finding Type: Internal control and compliance 

Compliance Area: Eligibility 

Known Questioned Cost: 

Medicaid - $292 

$292 is the federal charge paid by the State for an ineligible person in a test of 
$1,228,158 in non-pharmacy claims, a dollar error rate of 0.0238%. 
SCHIP - $3,465 + $1,354 = $4,819 

$3,465 is the federal charge paid by the State for ineligible persons in a test of $13,398 in 
non-pharmacy claims, a dollar error rate of 25.86%. 

$1,354 is the federal charge paid by the State for ineligible persons in a test of $5,024 in 
pharmacy claims, a dollar error rate of 26.95%. 

Likely Questioned Cost: 
Medicaid: $306,576 

$306,576 is the likely questioned costs projected by multiplying the total non-pharmacy 
expenditures of $2,011,149,043 for fiscal year 2006 by the dollar error rate 
(approximately .0238%) from the sample at the federal financial participation rate 
(approximately 64%). 
SCHIP: $3,978,636 + $856,562= $4,835,198 

$3,978,636 is the likely questioned costs projected by multiplying the total non-pharmacy 
expenditures of $20,296,184 for fiscal year 2006 by the dollar error rate (approximately 
25.86%) from the sample at the federal financial participation share (approximately 
75.8%). 

$856,562 is the likely questioned costs projected by multiplying the federal pharmacy 
based Medicaid expenditures of $3,177,383 for fiscal year 2006 at the dollar error rate 
(approximately 26.95%) from the sample. 
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Criteria: OMB Circular A- 102 Common Rule 
45 CFR §92.20 
42 USC§1320b-7(d) 

42 CFR §431.10, §435.916, §435.907, §435.913, §435.910, §435.920 

Condition: DHHS does not have adequate internal controls in place for the Medicaid and SCHIP 
programs to determine program eligibility, to maintain records of eligibility determinations or to 
charge the appropriate program for the associated costs of eligible individuals. 

We tested eligibility determinations for 180 Medicaid and SCHIP client payments; these 
consisted of 60 Medicaid and 40 SCHIP non-pharmacy payments and 40 Medicaid and 40 
SCHIP pharmacy payments. 

• For Medicaid, one (1.7%) of the 60 non-pharmacy clients was not eligible; all of the 40 
pharmacy clients were eligible. The ineligible client had no record in the Automated 
Client Eligibility System (ACES) and had no activity since 1998 in WELFRE (the legacy 
eligibility system.) As noted below, a high percentage of SCHIP clients tested were later 
determined to have been Medicaid eligible but charges were not moved to the Medicaid 
program. 

• For SCHIP, two (5%) of the 40 non-pharmacy clients and seven (17.5%) of the 40 
pharmacy clients were not eligible. The two non-pharmacy clients were not eligible for 
the SCHIP program; one was not eligible because other insurance was available, and one 
had not been eligible since 2004. All seven pharmacy clients had been determined 
eligible at the time payments were made, but were retroactively determined to be eligible 
for Medicaid, not SCHIP, as a result of additional information entered later. DHHS did 
not shift the associated charges between the programs when the eligibility determination 
changed, resulting in a disparity between program eligibility and program payments. The 
original eligibility determination was overwritten, and thereby deleted from the legacy 
eligibility system (WELFRE), with no audit trail. 

Context: Medicaid is a $2 billion program, funded 64% with federal financial participation. 
SCHIP is a $33 million program, funded 76% with federal financial participation. 

For the Medicaid and SCHIP programs, DHHS uses three interconnected computer systems: 
Automated Client Eligibility System (ACES), Welfare Information System (WELFRE), and 
Maine Claims Management System (MECMS) to determine client eligibility and assign client 
claims to the appropriate program for payment. Information flows from ACES to WELFRE to 
MECMS. It is necessary to look at all three in order to determine whether payments were made 
on behalf of eligible clients for allowable services by the appropriate program. 

OIAS is responsible for determining eligibility. Its eligibility specialists interview clients, 
maintain case files, and verify income and assets. The eligibility specialists use ACES to record 
their determination; ACES is a "realtime" system, which also captures information used in 
determining eligibility by ongoing data exchanges. WELFRE is a legacy system (the predecessor 
to ACES), which receives eligibility determination codes from ACES and assigns them to 
recipient aid categories (RAC codes). It then sends the information on to the "rules engine", 
which is operated by a contractor, Client Network Services, Inc. (CNSI), as part of MECMS 
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within OMS. MECMS has no direct access to ACES but references the RAC codes to process 
payments. It is in MECMS that the account coding takes place that assigns claims to either 
Medicaid or SCHIP for payment. 

Cause: DHHS administers both federal and State funded programs under a single catch-all 
entity, MaineCare, which results in a lack of clarity regarding individual client eligibility for 
specific federal or State program benefits. Medicaid, SCHIPS, Dirigo, and non State 
Supplemental are all treated as MaineCare, with the ACES programming and OIAS policy 
manuals written accordingly. This conflicts with Departmental obligations to simultaneously 
administer multiple, distinct federal and State funded programs. The lack of clarity is 
compounded because, while the OIAS ACES system determines eligibility, the OMS MECMS 
system determines which program(s) to charge. CNSI controls the program logic governing 
payments, and because OMS does not have it, OMS could not determine or explain why 
payments were made for individuals who are not shown as eligible. 

DHHS has no policy or procedures to synchronize retroactive changes in client eligibility to 
payment for those services; no policy or limit regarding how far back to change eligibility status; 
poor communication between its own offices; ineffective communication with the Department of 
Administrative and Financial Services - Office of Information Technology; and no control or 
policy regarding maintaining a permanent audit trail of eligibility determinations in the eligibility 
systems. However, MECMS downloads from WELFRE and maintains a complete history, which 
can be researched on an exception basis. 

Also, program assignment errors can occur because unique codes are consolidated into one as 
information moves from ACES to WELFRE. Although none were included in our test sample, 
certain client eligibility determination codes (MF19, MF31, MFLP, MFSC, MFSP and MFCC) 
in ACES are summarized into one RAC code (ME) in WELFRE. Individuals in these categories 
can be eligible for either Medicaid or SCHIP depending on the client's (or client's parents) 
income and age. Similarly, individuals may be coded eligible as Family Related Adult but be 
eligible for either Medicaid or the State funded Dirigo program, depending on income. 
Appropriate assignment to a program requires that income and/or age also be considered, 
however that information is not transmitted from ACES to WELFRE. 

With regard to the existence of other insurance, although the SCHIP client case file noted the 
existence of other insurance, OIAS did not properly consider it to determine the applicant 
ineligible, perhaps due to inadequate ACES programming. (Third Party Liability (TPL) 
information is also obtained by a separate DHHS unit to ensure that Medicaid is the payer of last 
resort but that TPL information is not incorporated into the ACES system for OIAS use in 
redetermining eligibility; TPL payments are perceived by OIAS as completely a function of the 
Office of MaineCare Services.) 

Effect: Program costs may be charged to the wrong State or federal programs. SCHIP is a much 
smaller program than Medicaid; it has a higher percentage of federal funding and has only 
limited funding available. Costs improperly allocated to SCHIP may result in funds not being 
available to provide services to eligible individuals. Costs may be disallowed for any ineligible 
client. SCHIP client paid co-pays may have been unwarranted. Medicaid costs are understated to 
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the extent that they were incorrectly paid by SCHIP. The SCHIP error rates constitute material 
noncompliance with federal eligibility requirements. 

As for ineligibility due to the existence of other insurance, while the other insurance would not 
cause an individual to be ineligible for Medicaid, it would cause children applying for SCHIP to 
be ineligible. Incomplete records result in inconsistent and misleading client eligibility 
information. The deletion or overwrite of client eligibility history by the Bull interface process 
(ACES to WELFPvE) results in the elimination of an audit trail and is, therefore, a control issue. 

Recommendation: We recommend that the Department: 

• Immediately establish a means to adequately trace activities related to the distinct federal 
and State funded programs, which are administered as MaineCare. 

• More clearly define and consistently support the coordination of specific roles assigned to 
the different agencies responsible for the administration of all DHHS programs, internal 
and external to the Department, including system operations carried out by DAFS/OIT. 

• Establish a policy regarding retroactive determination of eligibility and align the costs to 
the affected programs. 

• Secure and maintain programming logic for all systems activity. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services partially agrees with this finding, and offers the following: 

OIAS disagrees with the statement "With regard to the existence of other insurance, although the 
SCHIP client case file noted the existence of other insurance, OIAS did not properly consider it 
to determine the applicant ineligible ". This statement seems to imply that OIAS should find 
MaineCare Expansion eligible individuals ineligible because they have other health insurance. 

OIAS does not determine ineligibility for our MaineCare Expansion individuals on the basis of 
having health insurance. They can be eligible for MaineCare; the issue would be what finding 
applies, Title XXI or Title XIV. Currently there is no mechanism to ensure that children enrolled 
in Medicaid expansion bill appropriately to Medicaid (Title XIX) or SCHIP (Title XXI). It should 
be noted that on average only 10% of this population has insurance coverage other than 
Medicaid. The Department is currently exploring options to address this issue. Additionally, the 
Department is transitioning its claims management system to a fiscal agent. As part of that 
transition, it will be expected that the fiscal agent system, as part of its TPL component, can 
delineate between those children who do have insurance and those who do not, therefore 
ensuring appropriate billing to Title XIX or XXI. 

Specific to the statements regarding the process whereby computer systems (ACES, MACWIS, 
WELFRE, and MECMS) pass eligibility and RAC Code information between each other, the 
Department and the Office of Information Technology are reviewing the RAC process as DHHS 
transitions to a fiscal agent for claims management. 

There is an effort underway to explore the use and process of Recipient Aid Categories; the 
intent is to validate the way they are used within the different applications including ACES, 
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MACWIS, WELFRE and MECMS. During fiscal year 2008, the expected outcomes of this group 
will be: 

■ A documented understanding of how things work today; this document currently 
does not exist 

■ A list of known issues and potential solutions/corrections 

■ As necessary, recommendations for possible replacement of this process. 

A list of issues will be prioritized by the different business areas and added to the specific 
application work plans. The recommendations will be brought to senior management of DHHS 
and OIT to determine direction and prioritization of this work. 

Contact: Jim Lopatosky, DAFS/OIT/DHHS - Information Technology Director, 287-1921 
(12) 

Finding Title: Cost of Care not deducted from payments to nursing home providers 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Office of MaineCare Services (OMS) 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs/Cost principles 

Known Questioned Cost: $117 

This is the federal portion of an overpayment (3.57% of sample) made by the State to a nursing 
home provider. 

Likely Questioned Cost: $3,575,587 

The likely questioned cost amount was computed by applying the sample error rate of 3.57% to 
the population of federal expenditures for the Aged ($100,156,499). 

Criteria: 

• MaineCare Benefits Manual, Chapter 1, §1.09 

• MaineCare Eligibility Manual §4400 

• Cost Principles for State, Local, and Indian Tribal Governments (OMB Circular A-87, 
Attachment A, paragraph C) 

Condition: The Maine Claims Management System (MECMS) did not consistently deduct the 
Cost of Care assessment from payments to nursing homes. Detail testing of a sample of 60 paid 
claims revealed that a nursing home claim was overpaid because the Cost of Care assessment 
(co-payment) was not deducted. 
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Context: The State pays nursing home providers for services to Medicaid clients. In some cases, 
the amount paid by the State should be reduced by an amount the nursing home should be 
collecting from the client. The portion to be paid by the client is referred to as the Cost of Care. 

Cause: Logic errors exist in the electronic information system. From the advent of the MECMS 
development phase to the present, OMS has created 35 change control forms that have noted 
Cost of Care issues relative to claims processing. The noted deficiencies varied from incorrect 
Cost of Care amounts being deducted to no Cost of Care being applied to both new and 
adjustment claims. System users identified the following as possible causes: 

• Ineffective system edits 

• Illogical programming language regarding claim pricing 

• Unsound application patches 

• Errors in the placement of decimals during processing 

• Interface problems from the Automated Client Eligibility System (ACES) to 
WELFRE/MECMS resulting in information not carrying over 

Effect: Overpayments to providers 

Recommendation: We recommend that the Department close all "open" change control forms 
regarding Cost of Care. We recommend correction of the logical errors in the MECMS system 
and recovery of overpayments previously made to providers. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

A change control form was created for this issue (CCF #20060125-5) and was implemented in 
the first quarter 2006. Cost of Care is appropriately being deducted from nursing home claims 
at this time. 

There are other issues related to cost of care and co-payments that are being addressed in a 
MECMS development initiative - these errors have been scoped and technical requirements have 
been drafted, and is scheduled for implementation in January 2008. 

Nursing Homes are cost settled through DHHS Audit division and with the assistance of the 
Adjustment Unit; the audit scope is being expanded to include incorrectly paid claims, including 
claims where cost of care was not deducted. 

Contact: Robin Chacon, DHHS - Office of MaineCare Services (OMS), Claims Director, 287- 
2769 
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(13) 

Finding Title: Inadequate control system over multiple authorized rates 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Office of MaineCare Services 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs/Cost principles 

Known Questioned Cost: $23 

This is the federal portion of an overpayment made to a provider 
Likely Questioned Cost: $503,957 

The likely questioned cost was computed by applying the sample error rate of approximately 
0.29% to expenditures of $172.6 million of Mental Health and Mental Retardation Medical 
Payments. 

Criteria: 

• OMB Circular A- 87 

• MaineCare Benefits Manual, Chapter III §41, Day Treatment Services 

• MaineCare Benefits Manual, Chapter III §24, Day Habilitation Services for Persons with 
Mental Retardation 

Condition: The automated claims billing system does not have adequate internal controls in 
place to ensure that providers of certain services are being paid the correct amounts by the State. 
DHHS establishes multiple payment rates within the same procedure code. There is no control to 
prevent a provider from using billing rates that are higher than the authorized rates for specific 
service levels. 

Context: Our sample contained two such transactions. One was billed and paid correctly. The 
second was paid using an unauthorized, expired rate. 

Cause: Inadequate controls over the use of procedure codes and procedure code modifiers 

Effect: Medicaid costs increased due to billing errors or intentional misuse of payment rates 
within the same procedure code. 

Recommendation: We recommend that the Department develop the use of procedure codes and 
procedure code modifiers that will ensure providers are paid correct amounts for services. 
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Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

The current MMIS system does not allow for multiple authorized rates for the same provider 
location; therefore, when multiple FSD rates are authorized, the highest rate is loaded into the 
MMIS system. The contract includes a Summary of Services which lists each member and the 
rate the provider is approved for that member. 

For Section 24, Day Habilitation Services, the DHHS Audit cost settlement report corrects all of 
the issues cited in this finding, and the CMS 64 report is adjusted appropriately. DHHS believes 
this is an adequate control to mitigate the risks cited in this finding. 

For Section 41, Day Treatment Services, there is currently one provider that has two rates on 
MECMS for that provider ID. During fiscal year 2008, OMS will be reviewing options to correct 
this situation. 

Additionally, for other programs that are not cost settled, the Department will review options to 
correct similar situations, as they exist. 

Contact: Robin Chacon, DHHS - Office of MaineCare Services (OMS), Claims Director, 287- 
2769 



(14) 

Finding Title: Lack of effective policies and procedures to address Medicaid recipient fraud 
Prior Year Finding: No 
CFDA: 93.775, 93.777, 93.778 
CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028, 05-0505ME5048, 05-0605ME5048 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Health and Human Services (DHHS) 
Bureau: Office of Integrated Access and Support (OIAS) 

Finding Type: Internal control and compliance 

Compliance Area: Special tests and provisions 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: Program Integrity: Medicaid (42 CFR §455); Title 22 MRSA §13 
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Condition: DHHS does not have methods and criteria for identifying suspected Medicaid 
recipient fraud cases. Policies and procedures for investigating and referring suspected fraud 
cases to law enforcement authorities are insufficient. 

OIAS determines client eligibility for the Medicaid program. OIAS does not have the authority 
or responsibility for determining if the recipient received Medicaid services to which they were 
not entitled. Because DHHS does not have a policy regarding client overpayments for Medicaid 
services, overpayments are not quantified, tracked or recovered. Furthermore, because DHHS 
does not have a policy to assess whether the misrepresentation was intentional, no follow-up of 
potential abuse or fraud resulting from eligibility determinations takes place. 

DHHS Fraud Investigation and Recovery Unit (FIRU) is a part of OIAS. Although allegations 
of Medicaid recipient fraud may be referred to it by the Program Integrity Unit (PIU), FIRU does 
little with them. It focuses its work on referrals or overpayments made in the Food Stamp and 
Temporary Assistance for Needy Families (TANF) programs. Although FIRU adds potentially 
fraudulent Medicaid recipient claims to overpayment claims prosecuted in these two programs, 
there is otherwise no effort to identify Medicaid recipient claims. 42 CFR §455.14 requires that 
the Medicaid agency conduct a preliminary investigation whenever a complaint or identification 
of a questionable practice is received. Also, 22 M.R.S.A. §13 established FIRU to investigate all 
fraud involving funds administered by DHHS. 

Context: The Medicaid program is a $2 billion program that is generally (except for eligibility) 
administered by the Office of MaineCare Services (OMS). 

Cause: 

• There is a lack of communication and coordination of efforts to identify and investigate 
Medicaid fraud by various responsible organizational units (i.e. OIAS, OMS, PIU, DHHS 
Financial Management Services, FIRU, Medicaid Eligibility Quality Control Unit 
(MEQC) and the Medicaid Fraud Control Unit that is located in the Office of the 
Attorney General). 

• OIAS does not have the authority or responsibility to determine if the recipient received 
Medicaid services to which they were not entitled. 

• FIRU reports difficulty in obtaining information regarding Medicaid overpayments, 
claims paid, and services provided, which has prevented it from pursuing Medicaid cases. 

• Although allegations of Medicaid recipient fraud may be referred to FIRU by the 
Program Integrity Unit (PIU), it does little with them. 

• There is a lack of DHHS policies regarding quantifying, tracking and recovering client 
overpayments for services. 

• DHHS does not have a policy to assess whether the recipient's misrepresentation of 
information was intended to abuse or defraud the Medicaid program. 

• There is no follow-up of potential abuse or fraud resulting from eligibility 
determinations. 

Effect: Inadequate referral and follow-through on potential fraud means that program funds are 
not available for legitimate claims and overall Medicaid costs are higher than necessary. 
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Individuals who obtain benefits incorrectly, either by intentional or unintentional means, are not 
identified nor prosecuted; they suffer no consequences. This perpetuates abuse. 

Because the established policies and procedures do not adequately address recipient 
unintentional or intentional misrepresentation, there is no means to quantify the amount and 
pervasiveness of potential loss or to determine particular areas of higher risk. DHHS could not 
quantify any Medicaid recoveries relating to client eligibility. DHHS personnel noted minimal 
recoveries that resulted from prosecution of individuals who received direct payments for 
falsified mileage reimbursement records and falsified consumer direct attendant records. 

Recommendation: We recommend that the Department: 

• Establish policies and procedures to address authority and responsibilities for personnel 
involved in all phases of the fraud investigation and recovery processes, including 
intentional and unintentional misrepresentation of information for eligibility, the 
identification of ineligible individuals, quantification of the amount of the loss or 
overpayment, procedures to record and track overpayments and recoveries, and referral to 
law enforcement officials. 

• Consider initiating amendments to State law to provide a means to recover the value of 
medical benefits provided as the result of intentional or unintentional misrepresentation 
of personal circumstances by the recipient. 

• Establish procedures for the FIRU unit or other responsible personnel to identify 
potentially fraudulent cases resulting from intentional client misrepresentations and to 
efficiently access Medicaid claims transactions to determine client claims history for the 
purpose of determining the potential loss or overpayments. 

• Consider establishing a single unit or division to investigate and coordinate all fraud 
investigation and recovery activities. This unit should be independent and free of 
influence from program operations. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the recommendations around establishment of policies and procedures. 

OIAS does have the authority and responsibility for identifying and investigating recipient fraud, 
evidenced by the relevant section (sec. 1132) of the MaineCare Eligibility Manual: 

1132 REFERRAL TO THE FRAUD INVESTIGATION UNIT 

If it appears that a recipient has purposely misrepresented actual circumstances 
(such as living arrangement, income, or assets) in order to receive Medical 
Assistance, and the individual would not have been eligible to the same extent had 
the proper information been available at the time of application, redetermination 
of eligibility, or within 10 days of the change in circumstances, a referral to the 
Fraud Investigation Unit will be made. (See Section 1420.). 

The report will include: 

I. a detailed explanation of the misrepresentation and the effect it had on 
eligibility. 

II. a claims history indicating the services that should not have been paid. 
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Complaints received directly by the Fraud Investigation Unit from the community 
will be screened through the Director of the Medical Assistance Program to see if 
the individual is an active or former recipient. The Director will check the status 
and direct the Fraud Investigation Unit to the proper regional office if eligibility 
has existed. The Fraud Investigation Unit will then share its information with the 
regional office which in turn will determine the effect this information has on 
eligibility. 

The Department agrees that policies and procedures should be established to address authority 
and responsibilities for personnel involved in all phases of the fraud investigation and recovery 
processes. The Department also agrees that referrals for TANF and Food Stamps should be 
reviewed for Medicaid component, as applicable. 

Contact: Barbara VanBurgel, Director, Office of Integrated Access and Support, 287-3106 
(15) 

Finding Title: Re-determinations not timely 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Office of Child and Family Services 

Finding Type: Internal control and compliance 

Compliance Area: Eligibility 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 42 CFR §435.916 

Condition: DHHS did not complete timely re-determinations of client eligibility for two of 60 
Medicaid non-pharmacy clients who we tested. Both exceptions were Foster Care Title IV-E 
cases, of which our sample included five. Controls over Medicaid eligibility determinations for 
cases administered by Division of Regional Operations (DROMBOS) are not adequate. 

Context: Annual client eligibility reviews are required in order to ensure continuing client 
eligibility to participate in Medicaid. 
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Cause: No established procedures for timely client eligibility reviews. 

Effect: Noncompliance with annual eligibility review requirements may result in payments to 
ineligible participants and unnecessary costs to the program. 

Recommendation: We recommend that the Department complete all reviews on a timely basis, 
including those conducted by DROMBOS. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the recommendation that all eligibility reviews be completed on a timely 
basis. 

In the spring of 2007, the staff who complete all eligibility reviews for children in foster care 
transitioned from the Division of Regional Operations to the Office of Child and Family Services 
(OCFS). It is a clearly articulated expectation of staff that all eligibility determinations be 
completed timely. 

These twelve Financial Resource Specialists are supervised by the Title IV-E Program 
Specialist. As part of the transition, systems have been established to ensure timely reviews are 
made in all cases. Staff will continue to be reminded of the important connection between timely 
determinations, Medicaid, and its effect on funding. Additionally, staff attend monthly meetings 
and these, along with individual supervision, focus on the importance of timely reviews. 

Contact: Dulcey Laberge, DHHS - Division of Public Service Management, Director, 287-5064 
(16) 

Finding Title: State Income and Eligibility Verification System (IEVS) data exchange 
noncompliant 

Prior Year Finding: 05-67 

CFDA: 93.775, 93.777, 93.778, 93.767, 93.558, 10.551, 10.561 
CFDA Title: Medicaid Cluster 

State Children's Insurance Program (SCHIP) 
Temporary Assistance for Needy Families (TANF) 
Food Stamp Cluster 
Federal Award: 05-0505ME5028, 05-0605ME5028 
05-0505ME5048, 05-0605ME5048 
ME TANF05, ME TANF06 
2005IS251444, 4ME400401 

Federal Agency: U.S. Department of Health and Human Services; 

U.S. Department of Agriculture 
State Department: Administrative and Financial Services (DAFS) 
Health and Human Services (DHHS) 
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Bureau: Office of MaineCare Services (OMS) 

Office of Integrated Access & Support (OIAS) 
Office of Information Technology (OIT) 

Finding Type: Internal control and compliance 

Compliance Area: Eligibility 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 42 CFR §435.910 
45 CFR §205.55 
42 CFR §435.948(e), 435.953 
42 USC §1320b-7 

Condition: DHHS lacks adequate procedures to make full use of the information obtained 
through data exchanges and to comply with federal regulations. The Social Security 
Administration (SSA) transmits data in the form of bi-weekly BENDEX and daily SDX reports 
to the DHHS for use by the Income and Eligibility Verification System (IEVS) as part of its 
automated determination of applicant/client eligibility status. 

• Caseworkers are not provided with the BENDEX data to establish the client Date of 
Death. The IEVS data is therefore unavailable to prevent a determination of eligibility. 
Caseworkers rely on family members or nursing facilities to advise them when a client is 
deceased. 

• DHHS caseworkers do not review the monthly BENDEX error report for incorrect Social 
Security Numbers (SSN). No automated SSN mismatch reports are generated by ACES 
from the daily SDX exchange to flag potential SSN discrepancies for resolution by 
caseworkers. 

• DHHS regional supervisors do not use consistent methodologies to review and maintain 
data obtained from the Internal Revenue Services. DHHS directed supervisors to review 
the material on a sample basis and to review any effect on clients eligible only for 
MaineCare as the last priority, after TANF and Food Stamps. 

• DHHS did not change its State Verification and Eligibility System (SVES) data 
transmissions to SSA to comply with their guidelines; prior year audit testing noted that 
some transmissions were rejected due to coding differences. 

• ACES erroneously re-opened Supplemental Security Income (SSI) related cases, 
previously closed by OIAS, based solely on the identification of a new client SSN 
provided by the daily SDX exchange. 

Context: The State uses a single automated system, Automated Client Eligibility System 
(ACES), to determine individuals' eligibility for major welfare programs, including MaineCare, 
TANF, Food Stamps, and SCHIP. The State is required to verify the social security number 
(SSN) and other information of all recipients of federally-funded aid, and to obtain and use the 
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related data provided by the SSA in subsequent information exchanges to the State to determine 
the continuing eligibility of individuals. 

Cause: The data exchanges provide a multitude of data and reports for OIAS's use. Standardized 
procedures are necessary to ensure consistent and appropriate consideration of all information 
received. We noted the following: 

• Supervisory review procedures are inconsistent because DHHS has not provided 
supervisors with specific training or guidance to review the IRS data. 

• Caseworkers do not review the BENDEX report for incorrect SSN due to time constraints 
and because DHHS has not corrected a programming error that causes the report to 
erroneously identify many potential mismatches. 

• Policy has been established but procedures are not in place to provide assurance that 
potential SSN, income, and name errors flagged in ACES reports will be reviewed for 
resolution by caseworkers. 

• The State has not adhered to data coding requirements for State Eligibility Verification 
Systems (SVES) outbound transmissions. 

• ACES does not generate reports for case workers' use for either BENDEX Date of Death 
information or SDX potentially incorrect Supplemental Security Income Social Security 
Numbers. 

Effect: Resolution of potential SSN mismatch errors from these exchanges is critical for case 
management of Medicaid and SCHIP cases, as well as for TANF and Food Stamps. This is 
especially true for individuals whose Medicaid cases are SSI related, because they are 
determined Medicaid eligible based solely upon receipt or eligibility for SSI. DHHS never re- 
determines client eligibility for such cases because the Department relies on reports generated by 
ACES to alert caseworkers that clients may no longer be eligible. Also, because client data 
contained in the SSA systems is primarily SSN driven, discrepancies between SSA and DHHS 
records must be resolved. Inconsistent use of transmitted data may result in the following. 

• Case files may not be closed and benefits not discontinued in a timely manner 

• Unresolved potential SSN, income, and name errors in ACES and in any other systems to 
which the same client information is communicated 

• Known programming errors in the reports lessen user confidence in them and cause them 
not to be used 

• Caseworkers must rely on nursing homes and other facilities who receive MaineCare 
benefits, or relatives, to notify them of a client's death. These facilities do not always 
track or report this information in a timely manner and may continue to receive monthly 
medical payments as a result. 

• Inconsistent practices to utilize IRS data create the risk that the information may not be 
utilized as intended or that it may be unintentionally disclosed 

Recommendation: We recommend that the Department establish policies and procedures to 
consistently use SSA and IRS data during the client eligibility determination process; to prevent 
payments to ineligible clients/providers; and to comply with federal regulations. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services and the Department of Administrative and Financial Services agree with this finding. 
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During fiscal year 2007 many of the reports stated in this finding have been corrected. OIAS 
staff, supervisors and program administrators are provided instructions on handling all IRS 
information. During fiscal year 2008, OIAS will review the instructions and enhance the policies 
and procedures as needed. 

Contact: Brian Guerrette, DHHS/OIT/DAFS, Systems Section Manager, 287-1748 

Barbara VanBurgel, Director, Office of Integrated Access and Support, 287-3106 



(17) 

Finding Title: Client eligibility determinations incorrect and differing between systems 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778, 93.767 

CFDA Title: Medicaid Cluster 

State Children's Insurance Program (SCHIP) 
State Program: Drugs for the Elderly, Maine Rx 
Federal Award: 05-0505ME5028, 05-0605ME5028 
05-0505ME5048, 05-0605ME5048 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services (DAFS) 

Health and Human Services (DHHS) 
Bureau: Office of MaineCare Services (OMS) 

Office of Integrated Access & Support (OIAS) 
Office of Information Technology (OIT) 

Finding Type: Internal control 

Compliance Area: Eligibility 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: OMB Circular A- 102 Common Rule, 45 CFR §92.20; 42 CFR §433.32(a); 42 CFR 
§433.112, §433.116, §433.117, §433.119, and §433.131 

Condition: Controls are inadequate to assure that medical claims from providers are paid only 
for individuals who are eligible for the Title XIX Medicaid and XXI State Children's Insurance 
Program (SCHIP) programs. 

DHHS uses two automated eligibility systems: Automated Client Eligibility System (ACES) and 
Welfare Information System (WELFRE). ACES is a real time system that receives various data 
feeds and automatically acts on information entered to determine eligibility and enroll 
individuals in programs for which they qualify. WELFRE is another eligibility system, which 



44 



MEDICAID CLUSTER 



remains necessary to link ACES to the Maine Claims Management System (MECMS) and to the 
Maine Point of Purchase System for prescription drugs (MEPOPs.) WELFRE allows data entry 
but requires human action to determine eligibility and enroll individuals. MECMS does not pay 
claims based on the eligibility status shown in either ACES or WELFRE for a particular service 
date, but on the member eligibility tables that are created within MECMS by applying Client 
Network Services, Inc. (CNSI) Business Rules and Logic to information flowing through the 
system interfaces. Because the process transfers all records from WELFRE, about 72% of the 
records are for deceased or otherwise ineligible individuals. 

Context: We tested the sufficiency of controls over the interface/transmission of client eligibility 
data and the integrity of this data from system to system. We tested the reasonableness of 
Medicaid program client count data maintained in ACES and WELFRE, and the reference tables 
of the Medicaid Management Information System (MMIS)/MECMS, which are used to process 
claims, prepare reports, and administer the program in OMS. The data processing we tested 
resulted in the following: 

• In the fall of 2005, DHHS certified many individuals, some deceased, as eligible for 
DHHS programs for which they had not applied. DHHS automated systems generated 
$10.00 State Supplemental checks to a number of them. Many of those who received the 
checks, or their surviving relatives, contacted DHHS to complain: they wanted to know 
how DHHS had obtained their personal information; why very old addresses were being 
used; and why checks were issued to deceased relatives. Once aware of the problem, 
DHHS employees stopped some checks from being delivered by changing addresses in 
ACES from the individuals' addresses to regional DHHS office addresses. Caseworkers 
repeatedly closed some of the cases but the programming logic within ACES caused 
them to be re-opened. 

• DHHS relies on family members or nursing home employees for notice of death. We 
noted one overpayment to a nursing home after the death of a client. 

• ACES opened duplicate cases and generated unwarranted $10 State supplemental checks 
due to incorrect entry of social security numbers that did not match those in Social 
Security Administration income and eligibility (IEVS) data transmissions. Even if 
caseworkers closed the duplicate cases, the system automatically re-opened them each 
time the interface ran. ACES does not generate a Social Security Data Exchange (SDX) 
error report of potential SSN errors. 

• Eligibility Start Dates in ACES were not always logical, because some were much later 
than end dates. These dates were entered by OIT in order to flag incorrect eligibility 
coverages. However, other system users may not recognize that the data is intentionally 
illogical. 

• MECMS and ACES client eligibility data do not always agree. Seven of the 40 oldest 
Medicaid clients (18%) examined in June 2006 MECMS records were not eligible: five 
were deceased (one in 2002, two in 2003 and one in 2005); two were not eligible in 
ACES during the year. DHHS did not close ACES eligibility for two of the deceased for 
more than three years; the third is still open. 

• The Office of MaineCare Services (OMS) does not research warning or error messages 
generated during creation of the member eligibility tables; only "fatal errors" prevent 
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clients from being included in the MECMS eligibility tables. Additionally, the process 
may not be compliant with federal certification requirements because the results do not 
seem logical according to OMS personnel. For example, the two stage process for June 
2006 showed a higher client count for the second stage than the first. 

• OMS is attempting to add Social Security Administration income and eligibility (IEVS) 
data exchanges to MECMS that duplicate functionality that OIAS already has in ACES. 

Cause: 

• On August 7, 2005 OIAS performed a "data dump" moving information of the State 
funded Drugs for the Elderly and MaineRx programs from the legacy WELFRE system 
to ACES. When the information was housed in WELFRE, OIAS determined eligibility 
manually, based on information from individuals applying for assistance. When the data 
dump occurred, ACES automatically processed the old data from WELFRE, resulting in 
the unwanted and erroneous eligibility determinations and check issuances. 

• Incorrect entry of social security numbers and lack of error reporting caused ACES to 
open duplicate cases, even after manual attempts to close the case. Programming causes 
cases to reopen repeatedly. 

• The causes for the MECMS member eligibility table logic discrepancies are unknown at 
this time because CNSI did not document the code used to generate the reports that result 
in the creation of the monthly client files and the person who wrote the code left the 
company. 

Effect: The nature of the programs is such that, for the most part, although there were errors in 
eligibility, they did not result in overpayments. The overpayments that did occur were for small 
amounts and, other than one, were for direct payments to individuals and not overpayments for 
medical services provided. 

The client eligibility data recorded in the major DHHS program systems should be the basis for 
all payments charged to federal and State programs administered by the Department at some 
level; therefore systemic errors may have a material impact to financial statements in which 
related expenditures are ultimately charged. The reasonableness of this data should, therefore, 
provide some assurance that OMB A- 133 eligibility and allowable cost/activity requirements 
were met, in regard to federal programs administered under MaineCare. 

Some methods used by OIAS to systematically re-determine the program eligibility of 
individuals in ACES solely based on all data recorded in the WELFRE system or by the override 
of ACES systematic rules (the "rules engine") impacts the integrity of client eligibility data 
recorded in ACES as well as the payment systems that receive this information. Furthermore, the 
family members of some deceased persons on behalf of whom eligibility was determined in this 
method were forced to experience unnecessary emotional distress as a result, while others may 
have ignored letters and payments sent in error. 

For a real-time system, like ACES, which interfaces with a number of systems on a regular basis, 
it is not reasonable that OIT personnel run "data fixes" to intentionally create illogical start dates 
for client program eligibility, in an effort to make them readily identifiable to caseworkers. 
Some systems and reports obtain client eligibility data from ACES by start date and some obtain 
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it by end date to determine or account for DHHS program participation, and there is no guarantee 
that these dates will always be viewed in the same context. 

The Social Security Administration has an agreement with the State OIAS operations that the 
data from IEVS (SDX/BENDEX/Buy-In) interfaces is to be used to facilitate client eligibility 
determinations on a large scale basis (in ACES). If utilized without complete individual client 
case knowledge or appropriate OIAS caseworker review, efforts by OMS to add this 
functionality to MECMS seem duplicative and potentially detrimental to the integrity of client 
member reference tables used by the MMIS (MECMS) system operations for the processing of 
claims for payment. 

Recommendation: We recommend that the Department: 

• Immediately establish a means to adequately trace the Departmental activities related to 
the distinct federal and State funded programs which are administered under the single 
catch-all entity (MaineCare). 

• More clearly define and consistently support the coordination of specific roles assigned to 
the different agencies, internal and external to the Department, responsible for the 
administration of all DHHS programs, including system operations carried out by 
DAFS/OIT. 

• In order to ensure the continuity of operations and the provision of vital services, we 
recommend that the Department immediately establish an effective means to comply with 
IEVS requirements that has been established in documented Department policies and 
procedures. 

• Establish policies to provide assurance that IEVS information will be consistently and 
actively used during the client eligibility determination process. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the finding, and offers the following: 

(1) The Department agrees that the Maine RX/DEL conversion done in August 2005 
increased the possibility of erroneous checks being generated due to existing issues with 
the SDX interface. The Department has taken steps to improve the filters on the SDX 
interface. Based on the filters, the Department will create suspense records for case 
worker review rather than automatically opening a new case. Currently, when the worker 
finds that a duplicate case was opened, the worker is instructed to correct the 
mismatched data so that when information from SDX is sent to ACES again, it will not 
create a duplicate case. 

(2) The Department does rely on family members, yearly reviews or notification from the 
facility for notices of death. There is an ACES report, CME 007 - "Cases Where 
BENDEX Shows Client Deceased. " This is populated from the BENDEX inbound 
interface. Staff still need to follow up to confirm data on this report as it is not always 
accurate. 

(3) System start dates that are much later than the end dates in ACES is a design mechanism 
to invalidate a case record. 
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(4) There has been an issue where client eligibility data in MECMS and ACES does not 
agree. This can sometimes result in cases being closed in ACES and not in WELFRE / 
MECMS. This flaw has been identified and is being corrected. 

(5) A Steering Committee has been established to oversee WELFRE repairs, resolve open 
issues and put manual cross checks in place in the interim. The Committee will also 
define our interface strategy with the Fiscal Agent which may include a direct interface 
between the Fiscal Agent and ACES, eliminating WELFRE. 

Contact: Tom Keyes, DHHS - OIAS, Deputy Director, 287-2310 
(18) 

Finding Title: Reported client counts inaccurate 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Administrative and Financial Services (DAFS) 
Bureau: Office of Integrated Access & Support (OIAS) 

Office of Information Technology (OIT) 

Office of Medicaid Services (OMS) 

Finding Type: Internal control and compliance 

Compliance Area: Eligibility 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 

Standards for financial management systems: Accounting records; Internal control (45 CFR 
§92.20 (b)(2)(3)) 

Condition: DHHS is not able to support MaineCare client case counts included on various 
management reports. OIAS and OIT are responsible for correctly reporting client data on 
program eligibility; OMS does not perform tests to ensure the accuracy of client data. 

• Client counts reported were not consistent between reports for the same period. 
Between two reports that should contain identical information, the case count totals 
varied by 876 cases; totals by county varied by as much as 6,000 clients. 

• Client counts were overstated; reports included deceased clients. Client data 
provided by OIT-MECMS, OMS and OIAS included deceased persons: 335 in 
MECMS, 128 in OMS and 110 in OIAS ACES data. 
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• DHHS could not replicate queries to support reported information and could not 
always tell what information was being included in each category. 

The Automated Client Eligibility System (ACES) is not designed to systematically identify the 
individuals counted in management reports, requiring OIT personnel to query ACES for the data. 
However, the exact client data that ACES counts for each category identified in summary reports 
can not be traced to the underlying case records maintained in ACES. ACES coding does not 
clearly identify the State and federally funded programs for which individuals are eligible. 
Controls to ensure the accuracy of data provided as support are, therefore, inadequate. We note 
that the Department sometimes uses the term MaineCare synonymously with Medicaid, but 
MaineCare includes several other State and federally funded programs. 

Version controls over reports run in ACES are inadequate. At times, client count reports are 
generated manually using an old and outdated version of the program script. To correct such an 
error, the report is re-run with the current script version. The client count report generated by 
ACES queries for May 2006 and October 2005 summaries were incorrect (about 71,000 less than 
typical for the month). OIT personnel did detect and correct the May 2006 report, but not the 
October 2005 report. 

Context: ACES has evolved into the central intake and eligibility application for State and 
federal program assistance. OIT is responsible for the maintenance and functionality of ACES 
and the other computer systems used for the administration of all major DHHS programs. 

OIT personnel, who run and review these reports, rely on the experience and observation of 
others to identify instances in which report results appear incorrect. 

Cause: The system is not programmed to verify that individuals counted in management reports 
have underlying client records maintained in ACES. Version controls for summary reports are 
not in place. 

Effect: Client count data is misstated and could not be traced to underlying records in ACES. 

The individuals counted in these reports are used as the basis for Department- Wide cost 
allocations. Without adequate support or controls to provide assurance regarding the clients 
counted, only minimal reliance can be placed upon the accuracy of the cost allocations based 
upon ACES reporting of program client counts. 

Recommendation: We recommend that the Department establish a means to consistently 
provide accurate eligible client count information for federal and State funded programs, which 
are administered under the single catch-all entity MaineCare. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services and the Department of Administrative and Financial Services partially agree with this 
finding. 
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We are in agreement that there are known problems in the sharing of data between ACES, 
WELFRE and MECMS and we have projects under way addressing some of these issues. The 
projects are due for completion summer 2008. 

However we disagree with part of the finding where the reports examined should all yield the 
same counts/data. The reports identified in this audit are designed to meet specific needs of 
OIAS and look at the data in different ways. Certain programs may be included or excluded as 
needed and counts may be produced at a case or client level. Some results cannot be reproduced 
because it is a point in time look at the data. Even if it isn 't this type of report the retroactive 
eligibility associated with Medicaid will constantly change numbers for prior periods. 

Contact: Brian Guerrette, DHHS/OIT/DAFS, Systems Section Manager, 287-1748 

Auditor's Conclusion: While we agree that summary reports can and should be structured to 
look at data in various ways, the reports that we examined contained data specific to Medicaid. 
The client counts should have agreed as the reports were generated within a few days of each 
other, from ACES data, for the same prior month period. 

The finding remains as stated. 
(19) 

Finding Title: OMS unauthorized approval of non-timely filing 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778, 93.767 

CFDA Title: Medicaid Cluster 

State Children's Insurance Program (SCHIP) 
Federal Award: 05-0505ME5028, 05-0605ME5028 

05-0505ME5048, 05-0605ME5048 

05-0405ME5021; 05-0505ME5021 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Health and Human Services (DHHS) 
Bureau: Office of MaineCare Services (OMS) 

Finding Type: Internal control and compliance 

Compliance Area: Period of availability 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 42 CFR §447.45(d)(l) 
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Condition: OMS did not obtain official federal approval to change claims filing, correction and 
adjustment deadlines, although it verbally discussed the changes with the Centers for Medicare 
and Medicaid Services (CMS) prior to implementation. 

On June 1, 2006, OMS issued an advisory to all MaineCare providers that extended the claims 
filing deadline from the "allowable 12 months" to 20 months from the date of service; under 
certain circumstances extended the claims filing deadline to 23 months; and provided a further 
extension if there was evidence of a prior timely filing. OMS also waived the requirement that 
corrected claims be resubmitted within one year, and also waived the 120-day requirement for 
adjustments. 

Context: In January 2005, DHHS implemented a Medicaid claims payment management system 
(MECMS) that failed to work properly. The system failed to process many provider claims, 
could not issue timely payments or denials, and did not have the capacity to make claims 
adjustments within the required 120 days. 

Cause: 

OMS granted time extensions to providers because it believed these were necessary and 
appropriate due to the ongoing lack of MECMS functionality. 

Effect: 

• The General Fund may be liable for all claims processed in accordance with the June 1, 
2006 advisory. 

• The federal government could impose financial sanctions because the revised deadlines 
do not comply with federal requirements. However, a CMS official indicated that CMS 
was more interested in the State coming into compliance with federal requirements in 
January 2007, as promised. 

Recommendation: We recommend that OMS continue working toward resolution with CMS 
and the MaineCare provider community. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

In January of 2005, DHHS implemented a Medicaid Claims Payment Management System 
(MECMS) that failed to work properly. The system failed to process many provider claims, could 
not issue timely payments or denials, and did not have the capacity to make claims adjustments 
within the required 120 days. 

In February of 2006, the State of Maine revised Chapter I of the MaineCare Benefits Manual 
Timely Filing Requirements to read: 

1.10-2 Time Limit for Submission of Claims 

The following time limits apply unless waived under special circumstances by the 
Department, such as the Department's inability to process claims and/or 
adjustments: 
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Providers have one (1) year from the date services are provided to bill the 
Department, regardless of when eligibility is verified. Since it is the responsibility 
of providers to verify eligibility, members may not be billed for covered services 
that have been denied by the Department for exceeding the one (1) year limit for 
claims submission because the provider did not verify eligibility. 

During this time, OMS leadership was actively engaged in conversations with CMS and believed 
there was implied consent for waiver of the timely filing requirement based on significant 
deficiencies that hindered the timely processing of claims. 

The 120-day rule for processing adjustments is a state only requirement: 
1.12-1 Underpayments 

If a provider believes an underpayment has been made for covered services 
rendered, based upon policy and procedures as described in this Manual, the 
provider should accept and cash the check issued for the services provided. The 
provider must request a review of payments within one hundred and twenty 
(120) days of the remittance statement date or waive 
Effective any right to a review of that payment. The provider must request a review of 
2-2-06 the payment in writing and attach a copy of the remittance statement page 

indicating the underpayment. 

Consequently, OMS exercised the right to waive this requirement due to the absence of system 
functionality to process adjustments in MECMS. 

Initial timely filing conversations with CMS began in late 2005, to secure support to waive the 
timely filing limit due to system deficiencies and the in ability to receive and process claims. In 
June 2006, OMS and DHHS leadership corresponded in writing to continue to pursue approval 
to extend timely filing requirements to 18 months for claims submissions. In a written response 
from CMS, it was acknowledged that OMS would notify providers of the expiration of this 
extension as of January 1, 2007. A listserv e-mail was sent to providers on December 29, 2006. 

There are still deficiencies in the current MMIS system which prevent the timely processing of 
certain types of claims (i.e. hospital crossover claims) and discussions are continuing with CMS 
to identify these exceptions and explore workarounds to resolve these issues. 

Contact: Robin Chacon, DHHS - OMS, Claims Director, 287-2769 
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(20) 

Finding Title: Third Party Liability collections and cost avoidance data not reported 
Prior Year Finding: No 
CFDA: 93.775, 93.777, 93.778 
CFDA Title: Medicaid Cluster 
Federal Award: 05-0505ME5028, 05-0605ME5028 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Health and Human Services (DHHS) 
Bureau: Office of MaineCare Services (OMS) 
Office of Management and Budget 

Finding Type: Internal control and compliance 

Compliance Area: Reporting 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: Preparation of the Quarterly Statement of Third Party Liability (TPL) Collections and 
Cost Avoidance Form (§2500.3 Federal State Medicaid Manual) 

Condition: DHHS did not report Third Party Liability (TPL) information to the Centers for 
Medicare and Medicaid Services (CMS) for the period January 1, 2005 to June 30, 2006. On 
September 30, 2006, DHHS reported the omitted information on a cumulative basis. DHHS still 
did not report required Cost of Avoidance information for most Medicaid activity. 

Context: Medicaid is intended to be the payer of last resort. DHHS' TPL Unit ensures that all 
potential payers of medical services are requested to reimburse the program in order to offset 
expenditures. TPL recoveries and cost avoidance efforts directly result in millions of dollars in 
taxpayer savings for the Medical Assistance Program. 

On an annual basis, the Division of Financial Management in the Center for Medicaid and State 
Operations extracts TPL cost avoidance and collections data reported by the States on a quarterly 
basis to CMS on the CMS-64 Report. The data is used by CMS central office and regional office 
personnel to monitor and evaluate the effectiveness of States' TPL activity based on the varying 
methods used for recoveries. In addition to TPL data, State-reported total computable medical 
assistance payment (MAP) data (exclusive of adjustments) are extracted and presented to show 
the total TPL to total expenditures for Medicaid services. 

The State's new Medicaid Management Information System (MMIS) is still unable to generate 
cost avoidance data in terms of dollars saved; however, this data on behalf of pharmacy claims 
processed on the State's point-of-purchase system (MEPOPS) is available for reporting purposes. 
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Cause: 

• Lack of a functioning TPL subsystem in the Maine Claims Management System 
(MECMS) 

• Confusion over TPL reporting responsibilities and restructuring of the State Medicaid 
agency 

Effect: The program's financial reports have been incomplete and potentially misleading. 
Monitoring and evaluation of TPL collection and cost avoidance have been diminished because 
information has not been reported. In addition, past and future efforts will continue to be 
hampered because (except for pharmacy related claims) the State has not yet developed systems 
and procedures resulting in the reporting of cost avoidance. 

Recommendation: We recommend that the Department: 

• Develop and implement the needed change controls in MMIS in order to generate the 
necessary system critical reports denoting TPL collections and cost avoidance data. 

• Timely communicate all TPL collections and cost avoidance data for inclusion in the 
program's quarterly expenditure report. 

• Ensure that all duties are identified and re-assigned, if necessary, whenever there is an 
organizational change. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

1 ) TPL will continue to use the current method of reporting collections by gathering and 
preparing a spreadsheet that calculates collection figures for each of the TPL recovery 
areas using the weekly WELFRE Member TPL Financial reports until such time as the 
Fiscal Agent TPL sub-system is available. Medical claim cost avoidance reports are 
being developed and tested at this time and should be available by 9/30/07. This 
information will be combined with the pharmacy cost avoidance information on future 
CMS64 reports and TPL will report the information that we have been unable to obtain 
until now for the previous quarters as soon as that information becomes available. 

2 ) TPL will communicate collections and cost avoidance data to the individual involved in 
the preparation of the program's quarterly expenditure report within 21 days of the end 
of the quarter. 

3 ) Reporting requirements have been documented, documentation will be kept current, and 
staff has been cross trained in order to ensure that all reporting duties are reassigned 
properly and timely in the event of a future organization change. 

Contact: Rossi Rowe, DHHS - Third Party Liability, Division Director, 287-1838 
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(21) 

Finding Title: Medicaid financial reports do not satisfy requirements 
Prior Year Finding: 05-30 
CFDA: 93.775, 93.777, 93.778 
CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028, 05-0505ME5048, 05-0605ME5048 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Health and Human Services (DHHS) 
Bureau: Office of Management and Budget 

Finding Type: Internal control and compliance 

Compliance Area: Reporting 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 45 CFR §92.20 

Condition: DHHS reports of its expenditures for the Medical Assistance Program, Medicaid, are 
based largely on estimates rather than actual recorded expenditures. The State Medicaid Manual 
and other Centers for Medicare and Medicaid Services (CMS) guidance requires that only 
expenditures for which all supporting documentation is readily available and only actual 
recorded expenditures should be reported. 

We tested the accuracy and propriety of the quarterly expenditure report for the quarter ended 
September 30, 2005 and noted the following: 

• Certain State match amounts (also known as certified seed) totaling $55 million were 
reported based on mathematical calculations with no supporting documentation. 

• Waiver expenditures were not broken out, were not reported by fiscal year, and were 
improperly aggregated as current quarter expenditures. 

• The allocation factors applied to prospective inpatient and outpatient hospital payments for 
reporting purposes were carried forward from a previous reporting period and were not 
adjusted to reflect current quarter activity. 

For the audit period, the federal share of actual expenditures reported included approximately 
$131 million in "Interim Payments," which consist of actual payments made to providers 
based on estimates, not actual provider claims. 

Context: The federal government funds approximately 64% of the State's Medicaid program; 
the federal share of reported Medicaid expenditures is $1.6 billion. DHHS was reorganized at 
the beginning of the fiscal year to include the previously separate Department that administered 
mental health, mental retardation and substance abuse programs. DHHS activated a new 
Medicaid claims management information system (MMIS) in January 2005, called the Maine 
Claims Management System (MECMS). That system did not meet all Medicaid requirements 
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and caused significant disruptions in program operation. Many claims became suspended in the 
system, limiting payment and reporting of actual claims, and leading to payment based on 
estimates. At the end of fiscal year 2006, DHHS reported $507 million as interim (estimated) 
payments. DHHS is now trying to recover those payments from the providers; $184 million 
remains outstanding. 

Cause: DHHS has used estimates to report "Certified Seed" for some time, in part because the 
actual expenditures were incurred by agencies outside of DHHS and the actual expenditure 
information was not readily available to program accountants. Also, DHHS believed that 
reporting the calculated estimate was acceptable to the federal oversight agency. We do not 
question costs as our analysis shows that actual qualifying matching expenditures appear to 
exceed the amount reported. 

MECMS, implemented in January 2005, has not functioned properly and is incapable of 
generating reports that break out waiver expenditures by fiscal year. Further, the system cannot 
generate the hospital claims data used to calculate the payment ratios needed to distribute 
inpatient and outpatient hospital services for reporting purposes. 

Effect: The cost of providing Medicaid services is obscured to the extent that financial reports 
include estimates, require adjustment, and are not final. Estimated payments may not represent 
actual claims, may require recoupment from providers and repayment of the federal share. 
Changes to reported expenditures have a direct effect on the program's grant award for the next 
period; as expenditures are reduced, so is the award. The State is not in compliance with 
reporting instructions promulgated in §2500 of the State Medicaid Manual. 

Recommendation: We recommend that the Department: 

• Report actual State match expenditures. 

• Segregate and separately report Medicaid waiver program expenditures . 

• Determine the appropriate distribution percentages to be applied to prospective hospital 
payments and prepare the necessary CMS-64 adjustment to properly apportion costs . 

• Reconcile the total amount paid in interim claims to the total actual claims submitted that 
warrant payment and then collect any overpayment or pay any additional amount due. 

Management Response/Corrective Action Plan: Recently there has been a significant change 
in the reporting capability within MECMS/MMDSS allowing for improved reporting including 
submission of the CMS 64. Below are management's responses to the recommendations. 

Recommendation: We recommend that DHHS: Report actual State match expenditures 

Response: The calculation of State match amounts (certified seed) is a result of data being 
reported in two Approp Orgs yet combined for reporting purposes. Although a merged 
Department, the accounting structure still separates former BDS and DHS. The Department is 
researching options to obtain documentation that would support the certified seed reported on 
the CMS 64. For submission of fiscal year 2010/2011 biennial budget, all MaineCare expenses 
will be reflected in one Approp Org. Management has begun working with all parties to allow 
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the accounting system to more closely represent the activities and reporting requirements of 
DHHS. 

Recommendation: Segregate and separately report Medicaid waiver program expenditures 

Response: Effective with the 3/31/07 CMS 64, the HIV Waiver expenditures were broken out by 
year of service as required by CMS including adjusting all prior 8 quarterly HIV Waiver reports. 
By 6/30/07 it is anticipated that all Childless Adult Waiver expenditures will be broken out by 
year of service including all prior quarter adjustments to meet CMS 64 requirements. 

Recommendation: Determine the appropriate distribution percentages to be applied to 
prospective hospital payments and prepare the necessary CMS-64 adjustment to properly 
apportion costs 

Response: With the development of MMDSS for MECMS the Department is developing the 
reporting capability that will produce the appropriate cost distribution for hospital PIP 
payments that will meet the needed CMS 64 requirements. The allocation process will be based 
on prior period cost reports as provided by the Department' s Office of Audit. 

Recommendation: Reconcile the total amount paid in interim claims to the total actual claims 
submitted that warrant payment and then collect any overpayment or pay any additional amount 
due. 

Response: The Department provides CMS a quarterly reconciliation between the current 
balance of interims and the amount reported on the CMS 64. Interim payments were payments 
made in lieu of claims unable to process through MECMS upon its implementation in January of 
2005. They were estimated based on prior claims payments. It is appropriate to ensure that 
providers were not overpaid ( interim payments equal outstanding claims issues ); or in the case 
of overpayment, ensuring that those funds are recovered and the expenditure offset by that 
recovery. There is a significant effort being conducted at OMS on interim payment 
reconciliation. That effort involves ensuring that any interim overpayments are returned to the 
State and the federal share returned to the federal government. 

Contact: Colin Lindley, DAFS, DHHS Service Center - MaineCare Finance, Director, 287-1855 
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(22) 

Finding Title: HCBS Waiver annual report data can not be verified 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 

Finding Type: Internal control and compliance 

Compliance Area: Reporting 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: The State Medicaid Manual, §2700.6 et seq. requires the State to provide annual 
waiver assurance by submitting the Form CMS-372(S). 

Condition: Information reported on the 372 report cannot be verified. 

Context: A primary compliance requirement that a State must satisfy to participate in the Waiver 
is that the average costs for clients enrolled in the Home and Community Based Services Waiver 
program not exceed the average costs to Medicaid of providing services to clients in an 
Intermediate Care Facility. The 372 report includes the calculations that demonstrate compliance 
with the requirement. The report also summarizes Waiver expenditures by category and serves as 
a means for the federal government to monitor the Waiver. 

Cause: After January 2005, the Muskie Institute obtained data for the report by querying the 
Maine Claims Management System (MECMS). MECMS has had issues in processing claims and 
lacks certain functionalities; data may not be complete. The Muskie Institute cautioned that the 
data it provided are "...."as is" and should be used with appropriate caution." Because of 
MECMS processing issues, the State made "interim payments" to many of the Waiver providers 
based on estimated, not actual, costs. 

Effect: Users of the report must consider it in light of the disclaimer associated with the 
underlying data and take into consideration any effect that the interim payments and other claims 
processing issues may have. 

Recommendation: We recommend that the Department retain all supporting information for the 
report and appropriately caution any report users of the potential that it may be incomplete or 
contain errors or inaccuracies. 
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Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

CMS is aware of reporting issues. The Department is in the process of transferring responsibility 
for claims processing to a fiscal agent. As part of the transition, the fiscal agent will be required 
to provide standard Medicaid reports. 

Contact: Jane Gallivan, DHHS - Program Systems Director, 287-4212 
(23) 

Finding Title: Incorrect coding of crisis intervention services 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 

Finding Type: Internal control and compliance 

Compliance Area: Internal control and compliance 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 

• MaineCare Benefits Manual §21.05-1, The Individual Plan should describe at a minimum: 

o 1) The medically necessary services to be provided 

o 2) The frequency of provision of the services 

o 3) The type of providers authorized/eligible to furnish the services 

• MaineCare Benefits Manual §21.06-7 Crisis Intervention Services are required to be 

documented for the member in the provider's case record, including the scope, intensity, 
duration, intent and outcome of crisis intervention services. 

Condition: The Home and Community Based Services Waiver Program established payment 
rates for one client who was the sole resident of the provider's program, by dividing the 
provider's estimated costs in two, coding half to Personal Support Services and half to Crisis 
Intervention Services, using 168 hours (7 days X 24 hours) each week as the base for each rate. 
The Individual Care Plan did not provide any breakdown of the amounts or frequencies of either 
service. The provider's budget for this one client included 8.5 full time equivalent personnel and 
estimated costs exceeded $400,000. 
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We confirmed that the services were provided. However, the provider's care notes did not 
distinguish between the categories of service although the total hours billed were supported. The 
provider expects the client to need 40 hours of service each 24 hour day; the provider charges 
any service over 24 hours a day to Crisis Intervention. 

The Program paid the provider $140,381 for "Crisis Intervention" for this client in fiscal year 
2006. 

Context: The Home and Community Based Waiver Program expends approximately $221 
million annually for about 2600 clients. Of that, Personal Support Services expenditures 
constitute about $100 million for about 1,400 clients and Crisis Intervention Services about $1 
million for about 50 clients. 

Cause: The Medicaid Claims Management System has a limit check of 168 hours each week for 
Personal Support Services. Since the limit check rejected the extra hours of services, two charge 
codes were used. One charge code was for Personal Support Services and the other for Crisis 
Intervention Services. 

Effect: Miscoding the cost of services distorts accounting for the use of Waiver funds and the 
cost of providing services on both an individual and aggregate basis. Failure to complete 
Individual Care Plans adversely affects their ability to serve as a means to document the 
Program's identification of client needs and the allocation of sufficient, specific resources to 
meet them. 

Recommendation: We recommend that the Home and Community Based Services Waiver 
Program code expenditures consistent with Waiver definitions and include all required 
components in each Individual Service Plan. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the finding. 

The Department agrees past limitations within the claims system may have resulted in some 
limited distortion of services provided. In the case cited, crisis services were billed when a 2:1 
staff to consumer ratio was needed to prevent a likelihood of a crisis situation developing. 

This fall the Department will be moving to a standardized and published rate system which will 
remove any appearance that rates having been arbitrarily set. 

Contact: Jane Gallivan, DHHS - Program Systems Director, 287-4212 
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(24) 

Finding Title: Inadequate follow-up in cases of possible fraud 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778, 93.767 

CFDA Title: Medicaid Cluster 

State Children's Insurance Program (SCHIP) 
Federal Award: 05-0505ME5028, 06-0605ME5028, 05-0505ME5021, 05-0605ME5021 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Department of Health and Human Services (DHHS) 
Bureau: Office of MaineCare Services 

Finding Type: Internal control and compliance 

Compliance Area: Special tests and provisions 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 42 CFR §455 Subpart A; 42 CFR §457 Subpart I 

Condition: A lack of staff has caused delays in the Program Integrity Unit's (PIU) investigations 
of possible provider fraud. As of June 30, 2006, PIU had 190 open provider investigations. Of 
the six that we examined, PIU was not actively working two and had no one available to conduct 
an "informal review" of a third. 

Context: DHHS Medicaid and SCHIP expenditures exceed $2 billion. The Program Integrity 
Unit has three remaining full time staff. 

Cause: DHHS has reassigned two of five PIU staff to assist in other areas. 
Effect: 

• Fraud investigations are not timely 

• Possible recoveries of federal and State funds are not obtained 

• Possible fraudulent Medicaid provider billings are not detected 

Recommendation: We recommend that the Department make sufficient resources available to 
the Program Integrity Unit so that it can timely complete its investigations. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the recommendation. 

In the fiscal year 2008/2009 biennial budget, the Legislature appropriated funds and positions to 
the Program Integrity Unit. This will enhance the current processes that DHHS uses to be 
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compliant with the federal requirements for monitoring the Medicaid program for fraud and 
abuse. 

Contact: Herb Downs, DHHS, Office of Audit - Director, 287-2778 
(25) 

Finding Title: Controls do not ensure adequate program integrity and adequate surveillance and 
review 

Prior Year Finding: 05-63 

CFDA: 93.775, 93.777, 93.778, 93.767 

CFDA Title: Medicaid Cluster 

State Children's Insurance Program (SCHIP) 
Federal Award: 05-0505ME5028, 05-0605ME5028, 05-0505ME5021, 05-0605ME5021 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Health and Human Services (DHHS) 
Bureau: Office of MaineCare Services 

Finding Type: Internal control and compliance 

Compliance Area: Special tests and provisions 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 

• 42 CFR §455, §456, §457 (Subpart I) 

• MaineCare Benefits Manual, Chapter I §1.17-1.18 

Condition: DHHS does not have adequate internal controls in place to ensure the ongoing 
evaluation, on a sample basis, of the need for and the quality and timeliness of Medicaid 
services. DHHS does not have a post payment review process that allows State personnel to 
develop and review recipient and provider service profiles; nor to identify exceptions so that 
misutilization practices can be corrected. 

Context: DHHS Medicaid and SCHIP expenditures amount to approximately $2 billion. 
Utilization controls are necessary to safeguard against unnecessary or inappropriate use of 
services. 

Cause: 

• The Surveillance Utilization Review (SURS) subsystem of the State's new claims 
processing system is not currently functional 

• Lack of specialized software 
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Effect: 

• Noncompliance with utilization control requirements 

• Impaired ability to identify unusual payments that may result in failure to recover 
inappropriate payments 

Recommendation: We recommend that the Department: 

• Fully implement the SURS subsystem as a core Medicaid Management Information 
System (MMIS) subsystem. 

• Develop a post-payment review process that reviews recipient utilization and provider 
service profiles and identifies exceptions to correct misutilization practices. 

• Procure specialized software to allow the SURS unit to download and convert data from 
the claims processing system for subsequent analytical purposes. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

DHHS agrees that the current claims system does not have the capability to produce the 
sampling reports needed to evaluate services. Meanwhile, DHHS is working with the Office of 
Information Technology to develop COGNOS cubes which will provide limited profile data 
( anticipated implementation date: Late 2007). As the Department transitions MECMS to a fiscal 
agent, it will ensure that a comprehensive SURS component be included (anticipated 
implementation date: Early 2008). 

Contact: Herb Downs, DHHS, Office of Audit - Director, 287-2778 



(26) 

Finding Title: Claims processing and information retrieval system deficient 
Prior Year Finding: 05-03, 05-31, 05-56 
CFDA: 93.775, 93.777, 93.778, 
CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028, 05-0505ME5048, 05-0605ME5048 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Health and Human Services (DHHS) 

Administrative and Financial Services (DAFS) 
Bureau: Office of MaineCare Services (OMS) 

Office of Information Technology (OIT) 

Finding Type: Internal control and compliance 

Compliance Area: Special tests and provisions 

Known Questioned Cost: None 

Likely Questioned Cost: None 
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Criteria: 42 CFR §433.10-§433.131; 45 CFR §92.20; Section 11300 State Medicaid Manual 

Condition: DHHS has been unable to make the Maine Claims Management System (MECMS) 
function properly. Four of six core subsystems do not accomplish all federally required functions 
and objectives for a Medicaid Management Information System (MMIS). Deficiencies include 
the following: 

• The Claims Processing Subsystem cannot: 

o Ensure that all input submitted is processed completely 
o Ensure that reimbursements to providers are rendered promptly and correctly 
o Provide a prompt response to all inquiries regarding the status of any claim 
o Identify Third Party Liability (TPL) and assure that Medicaid is the payer of last 
resort 

• The Recipient Subsystem cannot support TPL recovery activities 

• The Surveillance and Utilization Review (SURS) Subsystem cannot: 

o Develop a comprehensive statistical profile of health care delivery and utilization 

patterns established by provider and recipient participants 
o Use computerized exception processing techniques to perform analyses and 

produce reports 

• The Management and Administrative Reporting Subsystem has limited ability to: 

o Report information to assist management in fiscal planning and control 

o Produce program data necessary for Medicaid reporting 

o Monitor third party liabilities and recoveries required by the State plan 

• MaineCare reports are created outside of MECMS by "workarounds" designed by the 
University of Southern Maine, Muskie Center, under contract with DHHS 

• From July 1, 2005 through June 30, 2006, OMS staff submitted 1,180 change control 
forms to the system developer to fix claim pricing errors, permission matrix problems, 
and edits that failed or were bypassed 

• Examples of specific processing problems follow: 

o MR waiver claims rejected due to interface problems between MR Enterprise 

Information System and MECMS 
o Some claims processed through the Fund Exception Matrix with no assigned 

accounting string 

o Claims paid at the wrong federal financial participation (FFP) rate 

o Insufficient cycle summary reports on dollar amounts paid to program providers, 

funds used, and accounts debited or credited 
o Duplicate payments made to providers that could not be quantified 
o A high volume of Suspended claims 
o Inability to re-price Void and Adjustment claims 
o Untimely hospital cost settlements using non-current data 
o Incorrectly priced Part B Medicare crossover claims 
o Failed processing system edits, as well as edits set to "ignore" 
o Claims in processing failure status 

o Noncompliance with Health Insurance Portability and Accountability Act 
(HIPAA) claims format 
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Context: Medicaid is a $2 billion federally and State-funded program. The Claims Management 
Information System is essential to its operation. 

Cause: DHHS converted to the new MMIS prematurely. The initial system breakdown can be 
attributed to the following: 

• An inadequate system development effort 

• Lack of a formal risk management process 

• Lack of effective testing before going into production 

• Procuring the services of a software vendor unfamiliar with the processing of medical 
claims 

Effect: MECMS problems have severely inconvenienced Medicaid providers; they continue to 
incur additional expenses, while trying to be reimbursed for services rendered. System problems 
caused hundreds of thousands of provider claims to "suspend" or fail to completely process, 
causing providers not to be paid. To provide cash flow that would allow the providers to stay in 
business, the State issued "Interim Payments" that were intended to approximate normal 
payments. As of June 30, 2006, Interim Payments totaled approximately $507 million. Lesser 
amounts continue to be paid in fiscal year 2007. 

Interim Payments are not associated with actual claims. As the System started to process actual 
claims, some providers were overpaid, as they received both types of payments. The State is now 
attempting to reconcile the Interim Payments to actual provider claims: to determine how much 
is still owed providers and to recover overpayments. The State estimated that approximately $21 
million might not be collectable. 

For two fiscal quarters, the federal government required the State to report not only the actual 
cash recoupments but also the amount of any provider agreements as adjustments on the State's 
Medicaid quarterly financial reports. The reductions of expenditures will result in reductions of 
the State's future Medicaid grant award and also the amount of federal cash available to be 
drawn. 

The State is itself experiencing cash flow and budgetary concerns because of MECMS. The 
State's General Fund temporarily absorbed the federal share of the $56 million of provider 
agreements reported but not actually recouped. Also, the federal government refused to share in 
costs associated with the flawed implementation resulting in extra costs paid from State 
resources. In addition to the original project contractors, the State has engaged other consultants 
to assist with the implementation and also to make recommendations to restructure the Office of 
MaineCare services. Consultants now provide some of the ongoing management of MaineCare. 
Costs for one consultant exceed $13 million; MECMS contractor and consultant costs to date are 
more than $64 million. The System was originally expected to cost approximately $16 million. 

The State engaged an actuary to estimate its liability for Medicaid claims incurred but not paid 
(IBNP). At June 30, 2006, the actuarial estimate for IBNP (exclusive of hospital cost 
settlements) was $520 million. The estimate included a 25% margin for adverse deviation, $104 
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million, due to the uncertainties associated with MECMS. The liability estimate was not reduced 
to reflect any Interim Payments due back to the State. 

A federal audit questioned the ability of MECMS to correctly process claims. The federal 
auditors recommended that DHHS reprocess all Medicaid claims since conversion; the State 
responded that the recommendation was not practical and instead planned to rely on quality 
testing. The Centers for Medicare and Medicaid Services (CMS) has not issued a decision on the 
recommendation. 

The ability of State agency personnel to complete their work has been adversely affected. Staff 
has been diverted to assist with stabilization efforts. Agency personnel have had no option but to 
use the new system, even while it continues to be developed. 

DHHS has decided to transition claims management to a fiscal agent due to the persistent and 
unresolved System problems. That arrangement is expected to take three years to become 
operational. The State has reached agreement with the original contractor to continue to operate 
and to correct problems while the fiscal agent solution is put into place. Much of the MECMS 
development and design was not documented such that another contractor or the State could 
operate the System without continuing contractor involvement. 

Recommendation: We recommend that the Office of MaineCare Services: 

• Develop a detailed plan for transition to the new fiscal agent model being considered 

• Develop a fallback capability during the transition 

• Continue stabilization efforts so that MECMS provides for uninterrupted service 

• Limit use of open-ended contracts; ensure that all contracts contain specific deliverables 
and provide for adequate DHHS oversight to ensure acceptable completion 

• Implement the full complement of processing system cycle edits 

• Generate a claims processing technical design plan 

• Fully rectify or close all processing system change control forms (identifying system 
errors and inadequacies) currently in "open" status 

• Investigate the status of each provider's unprocessed and suspended claims and 
determine their respective overpayment amounts, if any 

• Continue the formal recovery effort, which commenced in December of 2005, to recoup 
overpayments paid out in interim payments 

• Develop the means to generate a report of duplicate payments made to providers and 
recoup any overpaid amounts 

• Develop the means to generate the system reports critical to data control, provider cost 
settlements, and day-to-day management functions including the monitoring of program 
activity 

• Fully resolve with the federal government their recommendation to reprocess MECMS 
claims 

• Upon completion of a replacement processing system, migrate the rules engine and core 
subsystems to the new platform operated by the fiscal agent 

Management Response/Corrective Action Plan: DHHS agrees that the existing Medicaid 
Claims Management Information System (MECMS), implemented January 25, 2005 continues to 
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operate deficiently and without necessary functionality for Third Party Liability recoveries and 
Program Integrity. The following actions have been taken to remedy the situation: 

• In 2006, MaineCare Services was reorganized and directors were hired for key division 
areas: Customer Service, Claims, Communications, and TPL. Additionally, in January 
2007, management analyst positions and Quality Assurance staff were added in the 
Claims Division, to transition analytical and QA work previously supported by a 
consulting firm. At this time, only one project management role is held by a consultant. 

• With the cooperation of CMS, DHHS entered into an 18-month agreement with CNSI to 
implement nine system development initiatives to remedy major deficiencies in the 
current MECMS program. These initiatives include: 

o Interim Payment Recovery (IPR) Claims Hold - to assist in recovery of Interim 

Payments, implemented March 2007 
o J-Code Functionality - to allow OMS to comply with drug rebate requirements, 

implemented June 2007 
o Voids Functionality - to allow providers and OMS to void claims, to be 

implemented October 2007 
o Edits Processing Failure Initiative - to prevent claims from failing to process, 

resulting in "stuck " claims, to be implemented January 2008 
o Modifiers Initiative - to allow providers to bill HCPCS codes with appropriate 

pricing and descriptive modifiers, to be implemented January 2008 
o Co-pay and Cost of Care Initiatives - to process claims with correct 

consideration of co-pays and cost of care, to be implemented January 2008 
o Adjustments Functionality - to allow providers and OMS to adjust incorrectly 

paid claims, to be implemented March 2008. 
o Limits Initiative - to apply limits appropriately in the adjudication of claims, to be 

implemented in June 2008 

• In addition to the development initiatives, CNSI is to support operation of MECMS and 
correcting ongoing issues through a structured Patch process. Approximately three 
patches are implemented monthly to correct smaller data or processing issues. 

• During contract negotiations with CNSI in February 2007, OFT sent several staff 
members to CNSI Headquarters in Maryland, to fully train sufficient resources to take 
over system operations if needed. DHHS is confident that State staff could take over 
operations of MECMS if necessary. OFT continues to work with CNSI closely to 
automate systems operations maintenance functions to minimize dependence on human 
intervention. 

Even with these development issues, it is highly unlikely that the existing MMIS system will ever 
support the missing functionality or be certified by CMS. Consequently, in January 2007, DHHS 
announced the decision to pursue a Fiscal Agent solution. Since that time, the Department has 
submitted the required documents with CMS to begin this process. 

In July 2007, CMS provided the State with written approval of the accelerated procurement plan 
outlined in the PAPD. Under this approach, DHHS will perform a fit analysis, evaluate and 
select a vendor based on technical requirements in lieu of a full RFP process. This accelerated 
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approach will allow the State to save five months in the procurement process, selecting a vendor 
by January 2008 and implementing a new MMIS system by January 2010. 

Contact: Robin Chacon, DHHS, OMS - Claims Director, 287-2769 

OIT Management's Response: 

OIT agrees with the findings that the MECMS system is incomplete and not fully operating as 
intended. OIT concurs with the Department of Health and Human Services responses provided 
under their response to the findings. 

In addition, OIT has reviewed the recommendations suggested related to IT functions. 
Specifically - 

- Generate a claims processing technical design plan. 

There are actually several technical design plans (TDPs) that, when pulled 
together, describe the design of the claims processing within MECMS. 
Missing is the higher level document that ties the different plans together. 
Because of the move to the fiscal agent, the State does not intend to add this 
higher level design document, unless time and priorities permit. Rather, 
energy will be focused on ensuring the new solution has the appropriate 
documentation. 

- Fully rectify or close all processing system change control forms 
(identifying system errors and inadequacies) currently in "open" status 

There are a large number of system change control forms (CCFs) currently in 
open status for MECMS. Part of the decision to move to a fiscal agent and 
thereby a new technical solution recognizes this fact, and the decision will be 
to only address (correct and close out) those that are of the highest 
importance to MECMS processing, DHHS business, and provider activities. 
As a result, the majority will be left in open state when we move to the fiscal 
agent. This approach was also solidified in the current contract with the 
MECMS vendor, CNSI. 

- Upon completion of a replacement processing system, migrate the rules 
engine and core subsystems to the new platform operated by the fiscal agent. 
This recommendation is counter to the approach now under way for the 
implementation of an MMIS with a new Fiscal Agent. The rules engine and 
core sub systems will not be used going forward. The specific rules 
implementation and subsystem outcomes will be requirements of the new 
fiscal agent, but they will not be required to operate the existing system. 

Contact: Richard Thompson, DAFS, OIT, Chief Information Officer, 624-7568 
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(27) 

Finding Title: Inadequate security controls in Oracle Financials 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Office of MaineCare Services (OMS) 

Finding Type: Internal control 

Compliance Area: Special tests and provisions 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: Mechanized claims processing and information retrieval systems (42 CFR §433.110) 

Conditions: We noted the following weaknesses in computer systems security practices: 

• User access to Oracle Financials is not reviewed periodically. Users IDs for personnel 
who do not use the system are not revoked or deleted within a reasonable period. 

• A workflow module, which would require electronic supervisory approval of transactions 
within Oracle Financials, had not been implemented. This allows State agency personnel 
to enter payments directly into the system, which subsequently are paid by the State's 
primary accounting system, without further review or authorization. 

• Key programming staff at Client Network Services, Inc. (CNSI), the developer of the 
Maine Claims Management System (MECMS), has "super-user" access to Oracle 
Financials. Common controls in a data processing environment do not allow 
programming staff to have access to production systems. 

Context: Oracle Financials is an intermediate accounting system used between MECMS and the 
State's primary accounting system, Maine Financial and Administrative Statewide Information 
System (MFASIS). One purpose of Oracle Financials is to combine MECMS claims into 
invoices and to record receivables that result from interim payments to provider; it is also used to 
make other non-claim payments. 

Cause: 

• A number of new user IDs were established when the Oracles Financials system was 
implemented with the expectation that certain personnel would continue to require access 
to the system. These user IDs remain active for periods as long as a year or more despite 
the fact that users do not use the system. 

• Non-implementation of standard systems security practices 
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Effect: Personnel who may not have a legitimate business need may access the system and pass 
unsupported or unauthorized payments to the primary accounting system. 

Recommendation: We recommend that the Department improve systems security procedures 
by: 

• Reviewing user access to Oracle Financials and deleting or revoking user IDs for 
personnel who do not need to use the system. 

• Implementing the workflow module into Oracle Financials. 

• Considering methods to isolate vendor/programmer access from the production system in 
a manner that will not cause undue delay or complexity in transaction processing. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

Review user access to Oracle Financials and delete or revoke user IDS for personnel who do 
not need to use the system. 

A quarterly review of user ID 's will be implemented and unauthorized personnel will have their 
user ID 's access to the various modules end dated. New user ID 's access to various modules will 
need security level assignment and authorization. 

Consider implementing the workflow module into Oracle Financials. 

DHHS will be preparing an analysis of the impact of implementing the workflow module into 
Oracle Financial. DHHS projects the analysis to be complete during fiscal year 2009. 

Consider methods to isolate vendor/programmer access from the production system in a 
manner that will not cause undue delay or complexity in transaction processing. 

The MECMS and Oracle Financial systems are still in stages of development. Isolation of 
Vendor/Programmer access will be addressed when the systems become more stable. 

Additionally, as the Department transitions to a fiscal agent to manage Medicaid claims, vendor 
access will be isolated. 

Contact: Brian Guerrette, DHHS/OIT/DAFS, Systems Section Manager, 287-1748 
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(28) 

Finding Title: Noncompliance with Automatic Data Processing (ADP) review requirements 

Prior Year Finding: 05-60 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Administrative and Financial Services (DAFS) 
Bureau: Office of Information Technology (OIT) 

Finding Type: Internal control and compliance 

Compliance Area: Special tests and provisions 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 

• 45 CFR §95.621; 45 CFR §95.601 

• 45 CFR §95.621 requires the state agency to "establish and maintain a program for 
conducting periodic risk analyses... whenever significant system changes occur" and to 
"maintain reports of their biennial ADP (Automatic Data Processing) system security 
reviews, together with pertinent supporting documentation, for HHS on-site review." 
Furthermore, the requirements apply to programs covered under 45 CFR part 95, subpart 
F, which includes Title I, IV-A, IV-B, IV-D, IV-E, X, XIV, XVI(AABD), XIX, or XXI 
of the Social Security Act and Title IV Chapter 2 of the Immigration and Nationality Act. 

Condition: DHHS does not conduct formal security reviews of ADP systems on a biennial basis 
as required; and has not conducted and documented periodic risk analyses. While DHHS, 
supported by services provided by OIT, may have implemented many elements of a security plan 
as required including: (A) Physical security; (B) Equipment security; (C) Software and data 
security; (D) Telecommunications security; (E) Personnel security; (F) Contingency plans; (G) 
Emergency preparedness; and (H) Designation of an Agency ADP Security Manager; it has not 
formally implemented security review and risk analysis procedures and adequately documented 
the results. 
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Context: DHHS is responsible for the security of all ADP projects under development, and 
operational systems involved in the administration of DHHS programs within the scope of 45 
CFR part 95 subpart F. as follows: 



Social Securit 


y Act 


Title: 




I 


Grants to States for Old- Age Assistance for the Aged 


IV-A 


Block Grants to States for Temporary Assistance for 
Needy Families 


IV-B 


Child and Family Services 


IV-D 


Child Support and Establishment of Paternity 


IV-E 


Federal Payments for Foster Care and Adoption 
Assistance 


X 


Grants to States for Aid to the Blind 


XIV 


Grants to States for Aid to the Permanently and Totally 
Disabled 


XVI(AABD) 


Grants to States for Aid to the Aged, Blind or Disabled 


XIX 


Grants to States for Medical Assistance Programs 


XXI 


State Children's Health Insurance Program 


Immigration and Nationality Act 


Title: 




IV Chapter 2 


Refugee Assistance 



Systems subject to the requirements may include, but are not limited to: Automated Client 
Eligibility System (ACES), Maine Claims Management System (MECMS), the State's primary 
accounting system (MFASIS), Welfare Information System (WELFRE), Oracle Financials, New 
England Child Support Enforcement System (NECSES), Maine Automated Child Welfare 
Information System (MACWIS), Enterprise Information System (EIS), Managed Care System 
(MECAPS), Long Term Assessment Tool (MECARE), Immunization Registry (ImPACT), IBM 
and Bull mainframe systems, database servers, as well as the network infrastructure that supports 
those systems. 

Cause: 

• Lack of personnel and resources 

• Insufficient understanding or awareness of program requirements 
Effect: 

• Potential for inadequate safeguards to protect integrity and confidentiality of data 

• Potential for unauthorized entry into operations, data storage, library and other support 
areas 

• Potential for equipment loss or damage due to theft, sabotage, natural disaster or other 
threats 

• Noncompliance with federally promulgated system review requirements 

• Possible suspension or denial of federal financial participation for information systems or 
other penalties 
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Recommendation: To ensure that the level of security over DHHS' systems is adequate and to 
comply with regulations, we recommend that the Department: 

• Conduct the required biennial ADP system security reviews and maintain reports of 
results. 

• Establish a comprehensive risk analysis program. 

• Assess the adequacy of the protective measures and controls that are needed to meet the 
pertinent federal ADP security requirements and standards. 

• Continue to review the adequacy of those safeguards/controls on a biennial basis. 

• Make a determination of compliance with the ADP security requirements. 

• Write the policy and procedures of the ADP security program. 

Management Response/Corrective Action Plan: The audit finding suggests that a formal 
security review of Automated Data Processing systems does not occur on a regular/biennial 
basis, and that elements of a plan have been implemented in a scattered, non-formalized or 
organized, fashion. We partially agree with this finding. 

In fact, we do have areas where formal and organized reviews are performed on a regular basis. 
For example, we do an IRS safeguard review for NECSES and ACES every two years. This is a 
comprehensive undertaking, and takes into consideration OIT's Application Hosting, High Speed 
Printing and Data Center services. These are the same services that many of the other DHHS 
systems fall subject to, including MACWIS, MAP SIS, EIS, MFASIS, and WELFRE. 

We also have a security policy that has been aligned with HIPAA requirements. A contractor 
was brought on board to review and adjust our policy as necessary. 

That said, more systems need to have the same level of detailed review, and a comprehensive 
DHHS centric report should be compiled. In fiscal year 2008, OFT will develop a DHHS-wide 
report on application systems. The report will include the following components for 
applications: 

A. Physical security 

B. Equipment security 

C. Software and data security, including periodic penetration testing 

D. Telecommunications security 

E. Personnel security; Contingency plans 

F. Emergency preparedness 

G. Designation of an Agency ADP Security Manager( s ) 

In order to balance workload, it is envisioned that reviews will happen for half the applications 
in one fiscal year, the other half in the second. We will look at the feasibility of this report taking 
into account the DHHS IT Security policy, the IRS Safeguard Review, and SSA Review as well. 
The approach and plan will be developed by January 31, 2008. The schedule for implementing 
this plan will be included in this deliverable. 

Contact: Jim Lopatosky, DHHS - Information Technology Director, 287-2778 
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(29) 

Finding Title: Individual Care Plan authorized services incomplete 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778 

CFDA Title: Medicaid Cluster 

Federal Award: 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Health and Human Services (DHHS) 

Bureau: Adults with Cognitive & Physical Disability Services 

Finding Type: Internal control and compliance 

Compliance Area: Special tests 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: 

• 42 CFR §440.180; §441.301 

• Maine' s Waiver Agreement Appendix E-2 (b)( 1 ) 

• U.S Department of Health and Human Services, Understanding Medicaid Home and 
Community Services: A Primer 

• MaineCare Benefits Manual §21.05-1, §21.07, §21.07-1, §21.07-2 

Condition: Individual Care Plans (ICP) did not consistently document authorized services; 
authorized units did not always represent reasonable estimates of services considered necessary. 
Many Plans indicated full-time residential placements, but did not specify the amounts/units of 
service authorized or the frequency of service. Only a few checklists indicated 365 days of 
service and only a few units could be tied back to authorization in the treatment plans. 

• 28 of 60 (47%) Individual Care Plan narratives did not identify the amount and/or 
frequency of units of service authorized 

• 24 of 60 (40%) Individual Care Plans amounts or frequencies of service did not agree to 
the amounts reflected on Individual Checklists, which serve as the means of authorizing 
payment in the Claims payment system 

Context: Federal regulations require that all Waiver services be furnished pursuant to a written 
service plan that is developed for each waiver participant. 

Cause: DHHS considers the checklist a part of the Individual Care Plan and that it is not 
necessary to also include units in the narrative and then abstract them to the checklist. As DHHS 
allocates the provider's costs to whatever units of service are indicated, the units really serve 
more as a billing mechanism rather than a true measure of service delivered. 
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Effect: Individual Care Plans do not consistently document the amount and frequency of service. 
Checklist units and rates, which appear to represent the apparent costs to treat individual clients, 
are in large part a mechanism for the Program to cover total provider costs; the units and rates 
are not a reliable means to compare or contrast the costs of providing services to specific clients, 
especially as they are changed as needed to adjust client specific provider payments to cover 
provider costs. 

Recommendation: We recommend that the Department: 

• Provide guidance to its staff regarding consistent preparation of Individual Care Plans. 

• Establish meaningful units of service to be provided. 

• Ensure that the ICP narrative and checklists unit agree . 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with the recommendations of this finding, and believes it is in compliance. 

Each waiver participant has a personal plan developed annually. The Department does provide 
guidance and training to staff regarding consistent preparation of Person Centered Planning. 
The Department is willing to provide copies of the training materials on personal planning. 

The disagreement in the finding is around the development of the checklist which is used to 
establish the units of authorized services. 

The checklist is a distinct separate component of individual plans; its primary purpose is to 
identify the authorized units and cost per unit of each waiver service. Most often this is 
developed after the planning meeting has occurred based on the identification of the support 
needs of the individual. Hence, the checklist is a summary of the services defined in the original 
planning meeting. The Department is improving the checklist by adding improved descriptions of 
each service to ensure that staff is appropriately documenting necessary services. 

The Department has a review process for a sample number of person centered plans in order to 
verify that the narrative is inclusive of all services needed by the individual. 

This fall the Department will be moving to a standardized and published rate system which will 
remove any appearance that rates having been arbitrarily set. 

Contact: Jane Gallivan, DHHS - Program Systems Director, 287-4212 

Auditor's Conclusion: Our examination results indicated noncompliance. 

The finding remains as stated. 
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(30) 

Finding Title: Inadequate surveillance and utilization review of Medicaid prescription drugs and 
supplies 

Prior Year Finding: No 

CFDA: 93.775, 93.777, 93.778, 93.767 

CFDA Title: Medicaid Cluster 

State Children's Insurance Program (SCHIP) 
Federal Award: 05-0505ME5028, 05-0605ME5028; 05-0405ME5021; 05-0505ME5021 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Health and Human Services (DHHS) 
Bureau: Office of MaineCare Services 

Finding Type: Internal Control and compliance 

Compliance Area: Special tests and provisions 

Known Questioned Cost: $11 

This is the federal portion of one detected overpayment in a sample of 40 Medicaid prescription 
payments. A pharmacy dispensed a prescription for double the amount prescribed by the 
physician. 

Likely Questioned Cost: $329,009 

The likely questioned cost amount was computed by applying the error rate of .22% to the 
population of federal Medicaid expenditures for prescription drugs ($156,963,014). 

Criteria: 42 CFR §456. 1(b)(8) 
42 CFR §456.709 
42 CFR §456.716 

MaineCare Benefits Manual, Chapter II §80.04 

Condition: DHHS does not have an adequate drug use review program as required by 42 CFR 
§456. 1(b)(8). The drug use review program does not include the standardized retrospective 
examination of claims data required by 42 CFR §456.709. Section 709 requires that actions be 
taken to identify patterns of fraud, abuse, gross overuse, or inappropriate or medically 
unnecessary care by pharmacists; and DHHS does not provide the Drug Utilization Review 
Board with ongoing periodic claims data to identify these patterns. Because of the absence of 
other testing, we extended our examination by sampling 40 Medicaid prescription transactions; 
we detected 13 pharmacy dispensing exceptions as follows: 

• Four instances when the prescription was not dated and no follow-up with the physician 
was documented (including one instance involving a controlled substance) 

• One instance when the pharmacy dispensed and charged double the prescribed amount 
resulting in a federal questioned cost 

• One instance when the pharmacy could not locate the prescription 

• One instance when the prescription was not signed by the physician and no follow-up 
with the physician was documented 
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• One instance when it was the national pharmacy's policy not to obtain a signature 
acknowledgement that the prescription was picked-up 

• One instance when an out-of-state pharmacy claimed they could not provide a copy of the 
signature acknowledgement that the prescription was picked up due to a limitation 
imposed by their electronic system 

• Four other instances relating to unclear quantities, a missing drug description, an unclear 
dosage; combined with no documented follow-up with the physician 

Context: The Medicaid and SCHIP programs expended approximately $250 million for 
prescription drugs in fiscal year 2006. The MaineCare Benefits Manual, Chapter II §80.04, states 
that the goal of the Drug Utilization Review Committee is to assure that prescriptions are 
appropriate, medically necessary, and not likely to result in adverse results. 

Cause: Management's attention was directed to other areas; after the year of audit the pharmacy 
unit hired an analyst. 

Effect: 

• Pattern analysis using predetermined standards cannot be conducted as required by 42 
CFR§709 

• Fraud, abuse, gross overuse, or inappropriate or medically unnecessary care may not be 
detected on a timely basis 

Recommendation: We recommend that the Department have an adequate drug use review 
program, and provide the Drug Utilization Review Board with ongoing periodic drug claims data 
as required by federal and State law. 

Management Response/Corrective Action Plan: The Department of Health and Human 
Services agrees with this finding. 

The Department of Health and Human Services will provide the Drug Utilization Review Board 
with a standardized quarterly report ("Claims Trending Report") tracking defined pharmacy 
claim trends along with any recommendations for remedial action. 

The Program Integrity Unit will dedicate a position to focus on pharmacy reviews; it is 
anticipated that the position will be filled in December 2007. The position will be reviewing and 
addressing the conditions listed above. A quarterly report of the site findings will be submitted 
to the Manager of the Pharmacy Unit. The Manager will report the Dispensing Practices of 
Pharmacies to the Drug Utilization Review Board along with the Quarterly Claims Trending 
Report noted above. 

An assembled set of report criteria will be presented to the DUR at their December 2007 
meeting. The first report will be due at the February 2008 quarterly meeting. 

Contact: Carol Bean, DHHS - Comprehensive Health Planner II, 287-3941 
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(31) 

Finding Title: Inadequate internal controls and noncompliance with allowable costs 
requirements 

Prior Year Finding: 05-35 

CFDA: 10.551, 10.561, 93.558, 93.563, 93.658, 93.659, 93.767, 93.775, 93.777, 93.778 
CFDA Title: Food Stamp Cluster 

Temporary Assistance for Needy Families 

Child Support Enforcement 

Foster Care - Title IV-E 

Adoption Assistance 

State Children's Insurance Program 

Medicaid Cluster 
Federal Award: 4ME400401, METANF06, 0604ME4004, 

0601ME1401, 0601ME1407, 05-0405ME5021, 
0505ME5R21, 05-0505ME5028, 05-0605ME5028 
Federal Agency: U.S. Department of Agriculture 

U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services (DAFS) 
Bureau: Health and Human Services Service Center 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs/Cost principles 

Known Questioned Cost: Undeterminable 

Likely Questioned Cost: Undeterminable 

Criteria: General Administration - Cost Allocation Plans (45 CFR §95.507, §95.519) 

Condition: The Department did not implement adequate controls to ensure accurate 
financial reporting and compliance with the prescribed methods to allocate costs. The 
Department of Health and Human Services has an approved cost allocation plan that no 
longer reflects the current operation of the Department. The errors include: 

• Reported allocated costs were not based on final allocated costs 

• Incorrect amounts were entered on cost allocation schedules 

• Factor rates were not updated and could not be adequately supported 

Context: This is a systemic problem. 

Cause: 

• Staff turnover 

• Changes to cost allocation schedules for the Medicaid program were not 
communicated adequately to allow for accurate reporting of allocated costs 
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• The methodology for accumulating and allocating costs is not adequately 
documented 

Effect: 

• Inaccurate financial reports 

• Unallowable costs claimed 

• Potential future questioned costs 

Recommendation: We recommend that the Department continue in its efforts to develop 
and implement a revised cost allocation plan. 

Management Response/Corrective Action Plan: The Department of Health and 
Human Services and the Department of Administrative and Financial Services agree with 
this finding. While the causes cited were addressed in fiscal year 2006, continued staff 
turnover prevented the Department's ability to efficiently adjust and re-submit federal 
financial reports within that time frame. 

A Financial Analyst is assigned the task of managing the cost allocation plan. A 
Management Analyst processes the plan quarterly and posts bi-weekly funding and 
quarterly reconciliation journals, and these journals are reviewed and approved by the 
Financial Analyst. Prior year cost allocation schedule corrections were calculated in 
fiscal year 2006; staffing limitations and workloads of existing employees, however, 
caused these corrections to occur later than expected; this also caused delay to revisions 
to the federal reports. 

A new Department-wide Public Assistance Cost Allocation Plan (PACAP) was submitted 
to the federal Division of Cost Allocation (DCA) in New York in December 2005 and a 
revision was submitted in March 2006. These submissions were distributed by DCA to 
the cognizant agencies overseeing Maine DHHS activities. Preliminary inquiries 
regarding the plan were received by DCA and responded to in March 2007. 

Contact: Mark Toulouse, DAFS, DHHS Service Center - Deputy Director, 287-1869 
(32) 

Finding Title: Inadequate internal controls and noncompliance with federal cost 
principles 

Prior Year Finding: No 

CFDA: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.658, 

93.659, 93.667, 93.767, 93.775, 93.777, 93.778 
CFDA Title: Food Stamp Cluster 

Temporary Assistance for Needy Families 

Child Support Enforcement 

Child Care Cluster 

Foster Care - Title IV-E 
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Adoption Assistance 
Social Services Block Grant 
State Children's Insurance Program 
Medicaid Cluster 
Federal Award: 4ME400401, METANF06, 0604ME4004, 

G0501MECCDF, G0601MECCDF, 0601ME1401, 
0601ME1407, MESOSR05, MESOSR06, 05-0405ME5021, 
0505ME5R21, 05-0505ME5028, 05-0605ME5028 
Federal Agency: U.S. Department of Agriculture 

U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services (DAFS) 
Bureau: Health and Human Services Service Center 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs/Cost principles 

Known Questioned Cost: $2,129,301 ($1,249,000 SSBG; $880,301 CCDF) 
Likely Questioned Cost: Undeterminable 

Criteria: Cost Principles for State, Local, and Indian Tribal Governments (OMB 
Circular A-87) 

Condition: The Department did not have adequate procedures in place to ensure that the 
proper amounts of allocated costs were journaled to the various federal programs. The 
errors include: 

• Several programs paid excessive regional operations costs due to insufficient 
funding in other programs 

• Two programs paid excessive legal services costs (included in the questioned 
costs) 

• One program was not charged its share of Office of Integrated Access and 
Support costs 

• Total costs to be allocated to the various federal programs were calculated 
inaccurately 

Context: This is a systemic problem. Throughout the fiscal year, three Bureaus of the 
Department of Health and Human Services (DHHS) did not pay for their share of 
regional operations costs which totaled $6.7 million. As a result, the remaining DHHS 
programs paid $5.6 million in excessive regional operations costs, causing some 
programs to overdraw from their respective grants. Although this $5.6 million was 
returned to the program accounts in fiscal year 2007, the three DHHS Bureaus have not 
yet paid for their share of fiscal year 2006 costs. 

For fiscal year 2006, Social Services Block Grant (SSBG) paid for and reported $1.2 
million in excess legal services costs. The Child Care Development Fund (CCDF) paid 
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for and reported $1.3 million in excess legal services costs; however, since DHHS 
returned $392,800 to CCDF in September 2006, we will only question the remaining 
$880,301. We also note that CCDF requested and received an additional State 
appropriation of $3 million to cover program costs for which federal funds were not 
available. 

Cause: 

• Inadequate accounting procedures 

• Insufficient funds 

Effect: 

• Current and potential future questioned costs 

• Disproportionate share of allocated costs charged to federal programs 

Recommendation: We recommend that the Department implement accounting 
procedures to ensure that the State's accounting system adequately reflects the proper 
allocation of pooled costs. 

Management Response/Corrective Action Plan: The Department of Administrative and 
Financial Services, DHHS Service Center agrees with this finding. 

Funds were received in the fiscal year 2007 supplemental budget to correctly post 
regional operations costs for which federal funds were not available. As fiscal year 2007 
progressed, however, the regional operations account, which is funded by bi-weekly 
journals based on historical quarters, was able to partially correct the allocations via 
JV10A8107DW0006 in March 2007. The final reconciliation for fiscal year 2007 was 
posted via ABSJ 10A8107DW0003 in August 2007. The two journals transferred regional 
operations general funds (the latter journal from the fiscal year 2007 supplemental 
appropriation) on behalf of the three bureaus in question. Similarly, journals were posted 
in fiscal year 2007 correcting the fiscal year 2006 underpayment using fiscal year 2007 
supplemental funds. It is the Department's belief that, through these journal transfers, 
the bureaus in question have paid their respective portions of fiscal year 2006 and fiscal 
year 2007 costs. In the new department cost allocation plan, effective July 1, 2007, a 
reconciliation process is in place whereby those costs assigned to federal programs that 
cannot be absorbed by those programs due to federal fund participation (FFP) rates, will 
be transferred to the allocated account's general fund within a unit referring to the 
federal program assigned the cost. The first such reconciliation will be processed after 
quarter ending September 30, 2007. 

We agree that Attorney General fees charged were incorrectly posted. A correction 
returning funds to the child care development block grant from foster care and adoption 
assistance accounts was posted via JV 10 A 8107KK09018 on 9/27/06, covering quarters 
ending 12/31/05, 3/31/06, and 6/30/06. The Department feels it can perform analysis and 
post the remaining corrections before 10/31/07, the due date for the next quarterly IV-E 
report. 
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Contact: Mark Toulouse, DAFS, DHHS Service Center - Deputy Director, 287-1869 



(33) 

Finding Title: Inadequate internal controls and noncompliance with federal matching 
requirements 
Prior Year Finding: No 
CFDA: 10.551, 10.561, 93.563, 93.658, 
93.659, 93.775, 93.777, 93.778 
CFDA Title: Food Stamp Cluster 

Child Support Enforcement 

Foster Care - Title IV-E 

Adoption Assistance 

Medicaid Cluster 
Federal Award: 4ME400401, 0604ME4004, 0601ME1401, 

0601ME1407, 05-0505ME5028, 05-0605ME5028 
Federal Agency: U.S. Department of Agriculture 

U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services (DAFS) 
Bureau: Health and Human Services Service Center 

Finding Type: Internal control and compliance 

Compliance Area: Matching, level of effort, earmarking 

Known Questioned Cost: Undeterminable 

Likely Questioned Cost: Undeterminable 

Criteria: Uniform Administrative Requirements for Grants and Cooperative Agreements 
to State, Local, and Tribal Governments (45 CFR §92.20, §92.24) 

Condition: The Department did not have adequate controls to ensure that federal 
matching requirements were met with respect to allocated costs. We tested two 
allocation schedules, one to allocate legal services costs and another to allocate Office of 
Integrated Access and Support costs. We were unable to find State funded expenditures 
at the level necessary to meet the various matching requirements for the federal programs 
participating in these cost pools. 

Context: This is a systemic problem. For the two allocation schedules tested, State paid 
expenditures were deficient by $3.1 million to meet the various federal matching 
requirements. Federal funds were most likely drawn to cover some of the State's share of 
these allocated costs. However, due to the complexity with the accounting associated 
with the Department of Health and Human Services' cost allocation plan, we were unable 
to calculate unmet State match. 
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Cause: The Department assumes that the General fund appropriation received for the 
allocated cost pools is sufficient to help meet the State's matching requirements. 
However, no reconciliation is performed to ensure that this assumption is correct. 

Effect: 

• Possible noncompliance with federal matching requirements 

• Potential questioned costs 

Recommendation: We recommend that the Department implement procedures to ensure 
federal matching requirements are met with respect to allocated costs. 

Management Response/Corrective Action Plan: The Department of Health and 
Human Services and the Department of Administrative and Financial Services agree with 
this finding. 

While the quarterly reconciliation process assured that federal programs were not 
overcharged, match calculations could not easily be determined due to the various funds 
used in the Department' s allocated accounts. This issue has been addressed in the 
Department' s new cost allocation plan, submitted to the Division of Cost Allocation 
(DC A) in December 2005 with a revision submitted in March 2006. In the new plan's 
reconciliation process, expenditures assigned to a federal program but not chargeable 
due to the program's federal participation rate will be transferred to the allocated 
account's general fund within a unit (formerly report org) identifying the program. After 
a particular quarter's reconciliation process, queries can be executed that will identify 
both the amount of allocated costs posted to a particular program, as well as those costs 
retained in the allocated general fund account on behalf of that particular program. This 
new reconciliation process will begin with fiscal year 2008 allocated costs. The first 
reconciliation will take place in October 2007. 

Contact: Mark Toulouse, DAFS, DHHS Service Center - Deputy Director, 287-1869 
(34) 

Finding Title: Inadequate internal controls and noncompliance with SEFA reporting 

requirements 

Prior Year Finding: No 

CFDA: 93.268, 93.558, 93.563, 93.575, 93.596, 93.659, 93.775, 93.777, 93.778 
CFDA Title: Immunization Grants 

Temporary Assistance for Needy Families 

Child Support Enforcement 

Child Care Cluster 

Adoption Assistance 

Medicaid Cluster 
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Federal Award: H23/CCH122558, METANF06, 0604ME4004, G-0501MECCDF, G- 

0601MECCDF, G-0601ME1407, 05-0505ME5028, 05-0605ME5028 

Federal Agency: U.S. Department of Health and Human Services 

State Department: Administrative and Financial Services (DAFS) 

Bureau: Health and Human Services Service Center, Office of the State Controller 

Finding Type: Internal control and compliance 

Compliance Area: N/A 

Known Questioned Cost: N/A 

Likely Questioned Cost: N/A 

Criteria: Audits of States, Local Governments, and Nonprofit Organizations - Schedule 
of Expenditures of Federal Awards (OMB Circular A-133 §310(b)) 

Condition: The Department did not have adequate internal controls in place to ensure 
that it correctly reported expenditures for the Schedule of Expenditures of Federal 
Awards (SEFA) for six Department of Health and Human Services programs. 

Context: Initial SEFA expenditures were understated as follows: 

• Temporary Assistance for Needy Families - $6.3 million 

• Child Support Enforcement - $1.1 million 

• Child Care Cluster - $2.9 million 

• Adoption Assistance - $ 1 1 .6 million 

• Medicaid Cluster - $42 million 

Additionally, while the amount reported on the draft SEFA for the Immunization 
Program was essentially correct, the information used to compile the SEFA included two 
significant off-setting errors. 

Cause: 

• Insufficient understanding of how to appropriately compile SEFA expenditures 

• Inadequate oversight 

• Unrelated financial statement adjustments were incorrectly included in draft 
SEFA amounts for certain programs 

• The draft SEFA was not updated after revised expenditure reports were submitted 
to the federal government 

• Vaccines that were distributed and purchased with State funds were included in 
the draft SEFA 

Effect: Incorrect SEFA 

Recommendation: We recommend that the Department develop procedures to ensure 
that federal expenditures are correctly reported on the SEFA. 



84 



MULTIPLE PROGRAMS 



Management Response/Corrective Action Plan: The Department of Health and 
Human Services and the Department of Administrative and Financial Services agree with 
this finding. 

The SEFA (Schedule of Expenditures of Federal Awards ) report for fiscal year 2006 was 
a learning experience for many completing the SEFA for the first time; of the eight 
individuals working on the SEFA five were new to the process. After going through the 
process and reviewing the audit findings there is a much better understanding of SEFA 
reporting. 

Beginning with fiscal year 2007 SEFA all program accounting staff have been given the 
total MFASIS (Maine Financial & Administrative Statewide Information System) 
expenditures by program which ties to the total agency expenditure report sent out by the 
Office of the State Controller. Accounting staff have been instructed to balance the 
program Financial Status Reports to this figure and indicate reasons for variances. This 
procedure should assure a more accurate SEFA reporting. Notification will be sent to all 
accounting staff to inform the Financial Analyst responsible for SEFA reporting of any 
revisions to program Financial Status Reports. 

Contact: Donna Wheeler, DAFS, DHHS Service Center - Financial Analyst, 287-1860 

OSC has procedures in place to address agency filing issues from a number of 
standpoints. Our annual SEFA reporting instruction package includes detailed 
instructions for completing the SEFA, information on new and deleted programs and 
program name changes, and a reconciliation template that automatically removes 
transfers and donated items from totals reported in MFASIS, which includes definitions 
of transfers and pass-thrus in order to avoid confusion. Meetings are held with agency 
accountants needing assistance with preparing the SEFA, and we stress the importance 
of reconciling all programs back to MFASIS totals and reviewing transfers and pass- 
through amounts with other agencies to agency management. For fiscal year 2007 
reporting, we plan on holding a meeting with program accountants and the person 
responsible for preparing the SEFA in order to best clarify what expenses ought to be 
reported as expenditures. We have also updated the template with 3 cautions and pop-up 
comments when pass-thrus or transfers are identified. 

Contact: April Newman, DAFS - OSC, Financial Management Coordinator, 626-8436 
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(35) 

Finding Title: Inadequate controls over federal cash management requirements 
Prior Year Finding: 05-36 

CFDA: 93.558, 93.575, 93.778, 93.596, 93.775, 93.777 
CFDA Title: Temporary Assistance for Needy Families 

Child Care Cluster 

Medicaid Cluster 

Federal Award: METANF06, G-040 1 MECCDF, G-050 1 MECCDF, 05-0505ME5028, 

05-0605ME5028 
Federal Agency: U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services (DAFS) 
Bureau: Health and Human Services Service Center 

Finding Type: Internal control and compliance 

Compliance Area: Cash management 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: Rules and Procedures for Efficient Federal - State Funds Transfers - Rules 
Applicable to Federal Assistance Programs Included in a Treasury-State Agreement (31 
CFR §205 Subpart A) 

Condition: The Department did not have adequate internal controls in place to ensure 
compliance with the terms of the 2006 Treasury-State Agreement on cash management. 
Draws of federal cash were both earlier and later than the Agreement allowed. 
Additionally, the Department could not provide adequate supporting documentation for 
certain draws. 

Context: This is a systemic problem. 
Cause: 

• Timing of draws is not based on disbursement dates 

• Lack of adequate documentation to support amounts being drawn 

• Amounts drawn include adjustments for overall cash position which do not relate 
to specific program expenditures 

Effect: 

• Insufficient cash for the payment of disbursements 

• Excess federal cash on hand could result in an interest liability due the federal 
government 

Recommendation: We recommend that the Department: 
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• Improve grant accountability so that program managers and accountants are able 
to comply with the terms to the Treasury-State Agreement. 

• Consistently maintain adequate documentation to support draws of federal cash. 

Management Response/Corrective Action Plan: The Department of Health and 
Human Services and the Department of Administrative and Financial Services agree with 
this finding. 

As of July 2007, DHHS Service Center has assigned a financial analyst to oversee all 
cash management for the Department. This person has met with the Treasurer's Office 
CMIA ( Cash Management Improvement Act ) administrator and has started to implement 
procedures to limit draws to comply with federal cash management rules. 

Contact: Charles Woodman, DHHS Service Center - Deputy Director, 287-2572 
(36) 

Finding Title: Inadequate controls over the administration of federal funds 
Prior Year Finding: 05-21, 05-27, 05-35, 05-36 
CFDA: Various 
CFDA Title: Various 
Federal Award: Various 

Federal Agency: U.S. Department of Health and Human Services 

U.S. Department of Agriculture 
State Department: Administrative and Financial Services 
Bureau: Health and Human Services Service Center 

Finding Type: Internal control 

Compliance Area: Allowable costs/Cost principles, Cash management, Reporting 
Known Questioned Cost: None 
Likely Questioned Cost: None 

Criteria: Uniform Administrative Requirements for Grants and Cooperative Agreements 
to State, Local, and Tribal Governments - Standards for Financial Management Systems 
(45 CFR §92.20) 

Conditions: The Department does not consistently utilize separate accounts within the 
State's accounting system for each federal program. For some federal programs, 
"reporting organizations" are used for individual programs but are combined into a single 
"appropriation organization," which controls the cash for multiple programs. The 
Department is not always able to provide a complete and accurate list of the accounts 
established and used for each program. 



87 



MULTIPLE PROGRAMS 



The State's accounting records do not accurately reflect the sources and uses of funds. 
Transactions are not always posted or transferred to the relevant accounts. This is 
particularly true for costs related to accounts within the Department's cost allocation 
plan. Those costs are significant because they include regional office costs and other 
costs that benefit multiple programs. This process complicates the administration of 
federal funds. 

The Department "self-funds" some programs through a method they refer to as "earned 
revenue". This "earned revenue" is the result of federally qualified expenditures having 
been paid for with State funds. When the Department subsequently receives federal 
reimbursement, the State's General Fund is not refunded. Instead, these federal 
reimbursements are often transferred to Other Special Revenue Fund accounts and used 
to "self-fund" other Department programs. The "earned revenue" amounts transferred 
were sometimes estimates based on budgeted amounts that may not have agreed with 
actual qualified expenditures. In addition we noted that certain calculations to determine 
the "earned revenue" contained formula errors. This "self-funding" approach also makes 
tracing the sources and uses of funds difficult or, if proper documentation is not 
maintained, impossible. Additionally, we could not determine if the Department actually 
had legislative authority to retain the "earned revenue" rather than reimburse the General 
Fund. The Title IV-E Foster Care and Adoption Assistance Programs are examples of 
programs that used the "earned revenue" approach. 

Context: This is a systemic problem. 

Cause: 

• Incomplete written policies and procedures 

• Inadequate accounting structure 

• Overly complex accounting 

Effect: 

• Difficulty identifying sources and uses of funds 

• Insufficient supporting documentation 

• Noncompliance with federal regulations (e.g. cash management, reporting, 
allowable cost/cost principles, etc.) 

Recommendation: We recommend that the Department: 

• Establish and maintain a chart of accounts 

• Document all procedures in writing 

• Record all activity relating to specific programs into distinct accounts 

• Consistently review and reconcile account activity 

• Obtain legislative authority for use of "earned revenue" as a mechanism for self- 
funding or discontinue this process 
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Management Response/Corrective Action Plan: The Department of Administrative and 
Financial Services, DHHS Service Center agrees with the finding and has implemented 
many of the recommendations. 

Legislative authority for the use of "earned revenue" was granted in PL 2007, C.l, 
section V-l. 

The DHHS Service Center established the chart of accounts which was incorporated into 
the DHHS Cost allocation submission. 

The DHHS Service Center disagrees with the Department of Audit recommendation to 
use separate accounts within the State 's accounting system for each federal program. 
The effort to separately budget, maintain and report on over one hundred and fifty active 
grants is not possible given the current level of staffing. 

Contact: Charles Woodman, DAFS, DHHS Service Center - Deputy Director, 287-2572 
(37) 

Finding Title: Inadequate support for the Federal Cash Transaction Report (PSC-272) 
Prior Year Finding: 05-32 

CFDA: 93.041, 93.110, 93.234, 93.283, 93.556, 93.558, 93.563, 93.566, 93.596, 93.600, 

93.645, 93.658, 93.659, 93.671, 93.674, 93.775, 93.777, 93.778, 93.917 
CFDA Title: Title VII Elder Abuse Prevention 

Maternal and Child Health 

Traumatic Brain Injury 

Investigations and Technical Assistance 

Promoting Safe and Stable Families 

Temporary Assistance for Needy Families 

Child Support Enforcement 

Refugee Assistance 

Mandatory and Matching Funds of Child Care Development Fund 
Head Start 

Child Welfare Services 
Foster Care Title IV-E 
Adoption Assistance 
Family Violence Prevention 
Chafee Foster Care Independence 
Medicaid Cluster 
HIV Care 
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Federal Award: 06AAMET7SP, H74MC00003-A0, P05MC00061-A0, 0CCU122825, 
0CCU122057, 0501ME00FP, 0601ME00FP, 0501METANF, 
0404ME4004, 9804ME4004, 9704ME4004, 9904ME4004, 0604ME4004, 
0204ME4004, 0104ME4004, 05AAME1100, 06AAME1100, 
06AAME1110, 0601MECCDF, 0601ME1400, 0401ME1401, 
0501ME1407, 0401MEFVPS, 0601ME1420, 0501ME1420, 
01CD000805, 0605ME5048, 0405ME5028, 0505ME5028, 0605ME5028, 
HAX070023O 

Federal Agency: U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services 
Bureau: Health and Human Services Service Center 

Finding Type: Internal control and compliance 

Compliance Area: Reporting (PSC-272) 

Known Questioned Cost: None 

Likely Questioned Cost: None 

Criteria: Uniform Administrative Requirements for Grants and Cooperative Agreements 
to States, Local and Tribal Governments - Standards for Financial Management Systems 
(45 CFR §92.20) 

Condition: The Department did not have adequate procedures to ensure that the Federal 
Cash Transaction reports (PSC-272) were properly supported. As a result, the 
Department could not provide support for reported expenditures for thirteen of twenty- 
one programs drawn against letter of credit Y180P and four of fifty programs drawn 
against letter of credit 4578G. 

Context: We reviewed reports for the quarters ending September 30, 2005 and June 30, 
2006. Issues were found in both quarters. In certain instances, expenditures were based 
on estimates; in other instances, supporting documentation could not be provided for the 
reported amounts. 

Cause: 

• Supporting documentation was not retained 

• Estimates were used to report expenditures 

Effect: Expenditures reported were not properly supported. 

Recommendation: We recommend that the Department maintain and provide adequate 
support for the PSC-272 reports. We further recommend that the Department report 
actual expenditures and not estimates. 
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Management Response/Corrective Action Plan: The Department of Health and 
Human Services and the Department of Administrative and Financial Services agree with 
this finding. 

The Health and Human Services Service Center will review the eleven out of seventy -one 
programs that were deemed to have inadequate documentation. On all new grant awards 
received since FY 05, actual expenditures are reported. It is the Department' s policy to 
retain adequate documentation supporting the amounts reported on the PSC 272 report. 
We will take immediate action to ensure staff members are aware of the policy and 
provide ongoing monitoring to ensure proper documentation is being provided and 
retained. 

Contact: Liz Hanley, Director, DAFS, DHHS Service Center, 287-1861 



(38) 

Finding Title: Excess working capital reserves 
Prior Year Finding: 05-34 
CFDA: Various 
CFDA Title: Various 
Federal Award: Various 

Federal Agency: U.S. Department of Health and Human Services 
State Department: Administrative and Financial Services (DAFS) 
Bureau: General Government Service Center 

Finding Type: Internal control and compliance 

Compliance Area: Allowable costs/Cost principles 

Known Questioned Cost: $9.4 million Retiree Health Insurance Fund; $4.8 million 
Employee Health Insurance Fund; $1.6 million Office of Information Technology Fund. 
Questioned costs were calculated by multiplying the excess reserves by the percentages 
paid by federal programs by the individual fund. 

Likely Questioned Cost: $15.8 million 

Criteria: Cost Principles for State, Local and Indian Tribal Governments (OMB Circular 
A-87 Attachment C §G (2)) 

Condition: The Department did not comply with federal working capital reserve 
requirements. The Retiree Health Insurance Fund, the Employee Health Insurance Fund, 
and the Office of Information Technology Fund had excess working capital reserves of 
$53.7, $27.5, and $5.9 million respectively, for fiscal year 2006. These amounts were 
included in the DAFS cost allocation plan submitted to the U.S. Department of Health 
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and Human Services in December of 2006. All amounts exceeded the 60 days of 
working capital allowed to be reserved in accordance with Circular A-87. 

Context: The amount, if any, of excess working capital reserves is determined on an 
annual basis by DAFS. Although rates are periodically adjusted, rates charged were 
higher than needed to offset expenditures 

Cause: Management decisions; Lack of history of incurred but unreported employee 
health claims 

Effect: Current and potential future questioned costs 

Recommendation: We recommend that DAFS adjust billing rates to ensure compliance 
with federal working capital reserve requirements. 

Management's Response/Corrective Action Plan: We agree that $9.4 million Retiree 
Health Insurance Fund, $4.8 million Employee Health Insurance Fund, and $1.6 million 
Office of Information Technology are reasonable estimates of the federal share of 
reported excess retained earnings at June 30, 2006. 

Retiree Health Insurance Fund: 

Prior to fiscal year 2005, the State had been in the process of changing funding of retiree 
health care benefits from a pay-as-you-go basis to an actuarial funding method. Due to 
budgetary constraints and difficulties accumulating sufficient resources to fund retiree 
health care benefits on an actuarial basis, PL 2003, Chapter 673 authorized the State to 
manage the retiree health insurance fund on a cost-reimbursement basis beginning June 
30,2005. 

During fiscal year 2006, the State Controller and the Commissioner of Administrative 
and Financial Services took action to conduct research to determine the best course of 
action for the State and the current and retired employees of the State with regards to 
implementation of GASBS 45, Accounting and Financial Reporting by Employers for 
Post-employment Benefits Other Than Pensions. The State must implement GASB 45 in 
fiscal year 2008. An actuarial consultant was hired to calculate an appropriate 
valuation of the unfunded liability in-light of the plan's assets and assist in developing an 
explanation of the process put into place to educate the Administration, Legislature, and 
interested public about GASBS 45 and the need to address the liability that had accrued 
over the years that the fund was managed on a pay-as-you-go basis. In light of these 
circumstances, management decided not to take any action to return the fiscal year 2006 
excess reserve balances calculated on a pay-as-you-go basis as it became clear that it 
was in the best interest of the State to revert back to funding the liability on an actuarial 
basis. 

The actuaries have finished their initial valuation and have recommended an 
amortization and funding plan consistent with GASBS 45. Legislation has been enacted 
in PL 2007, Chapter 240, Part RRR to establish a trust for OPEB and to fund the Retiree 
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Health Program on an actuarial basis using the current plan 's assets to make an initial 
deposit. 

Employee Health Insurance Fund: 

The State became self insured for employee and retiree health coverage on July 1, 2003. 
An independent contractor provides claims administration services. The State pays the 
contractor a monthly premium fee based upon a rate that is determined with the 
assistance of an actuarial consultant. At the end of the year, premium payments are 
compared to actual claim payments and the outstanding balance owed or due is settled 
with the contractor. As this is a new self insurance program for the State, determining an 
appropriate rate based upon prior claims history in order to build adequate reserves for 
incurred but unreported claims is a challenge. The Department is currently reviewing 
the activity in the Employee Health Insurance Fund in order to determine the cause of the 
apparent excess reserve and whether funds should be returned to the supporting 
agencies. 

The excess reserve balances noted in the finding are based upon OMB A-87, which 
allows for a working capital reserve of 2 months. Title 5, subsection 285, paragraph 9 
establishes restrictions for self-insured programs including the requirement to maintain 2 
Vi months of premium equivalent in reserves. The Department plans to contact the 
federal government to request an increase in the working capital reserve to allow for 2 V2 
months of reserves to comply with Title 5. 

Office of Information Technology: 

The Cost Allocation Plan excess retained earnings were $5.9million at 6-30-06 with the 
federal share calculated as $1.6million. The excess retained earnings were calculated 
based upon allowing a reserve for the cost of 60 days of operations, per OMB Circular 
A-87. However, A-87 says a working capital reserve exceeding 60 days may be approved 
in exceptional cases. In February 2007 the Office of Information Technology submitted a 
written request to the federal DHHS Division of Cost Allocation requesting a 120 day 
operating allowance through June 30, 2008. This letter was written in response to a 
Division of Cost Allocation request for resolution of fiscal year 2005 questioned costs. 

The February 2007 letter to the federal DHHS Division of Cost Allocation outlined the 
many steps that OIT has taken to reduce and control retained earnings growth, including 
rebates to State agencies and several rate reductions. A radical reorganization of state- 
wide technology services in fiscal years 2006 and 2007 merged all technology services in 
to one Office of Information Technology. The restructuring will generate higher levels of 
expenses, resulting in a much larger 60 day allowance in future fiscal years. 

We are awaiting the Cost Allocation Office 's determination on our appeal for a higher 
retained earnings allowance that will be sufficiently high to resolve the questioned costs. 
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Medicaid Audit Team FY 2006 



Staff: Program Areas Tested: 



Carol A. Lehto CPA, CIA 


Interim Payments 


Deputy, Single Audit — Manager 


HCBS Waiver 
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HIPAA Compliance 




USM -Muskie Co-Operative Agreements 




Policy review - Filing deadlines 




Contracts - Sole Source, MECMS 




DHHS Purchased Services Division 


Robert J. Rocheleau 


SEFA 


Senior Auditor - Co-lead 


Hospital Payments/Cost Settlements 




Federal Financial Reporting 




Provider Audits 




Financial Statement testing, Actuarial and all other accruals 




Analytical Review - Variance testing 
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Provider health & safety standards 




Medicaid State Plan 




MECMS change orders 




SCHIP: Matching, Reporting, MOE, Earmarking 




Allowance for Bad Debts 


Pola Buckley CPA, CISA 


Provider Fraud - Program Integrity Unit/SURS 


Principal Auditor, Co-lead 


Pink and green - Claims adjustment sheets 
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Pharmacy/prescription drugs 




Cost of care co-payments 




Medicare Part B 




Third Party Liability 




Allowability 


Thomas Randall 


IBNR - MECMS/MFASIS reconciliation 


Spmnr Auditor 


J. A A V^oUlllg, Wl tH/lt A liluil^lclld 




Matching - Certified Seed 




Fraud Investigation Recovery Unit - Recipient Fraud 




Targeted Case Management 




Quality Assurance Testing 




COGNOS queries 



Amanda Spencer, CISA Eligibility - Medicaid & SCHIP 

Senior Auditor IT Testing - Eligibility Systems: 

ACES , MACWIS, WELFRE interface to 
payment systems and related roles: 
MECMS, CNSI 



IT Contract Reviews - ACES , WELFRE, MECMS 
Case File Reviews - Eligibility 
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